Check this out: https://code.google.com/p/volatility/wiki/CommandReference#strings

On Wed, Nov 13, 2013 at 7:22 AM, Matthew Wong <matthew@coredumps.net> wrote:

Hello All,

I'm new to Volatility.

Say I found the string "password=hello world" somewhere in the memory, is there anyway for me to know which process that memory block is currently allocated to?

--
matt

_______________________________________________
Vol-users mailing list
Vol-users@volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users