Re: [Vol-users] TrueCrypt File Found in Handles extraction, but can't replicate results

Thanks Jamie for the information... I ran the FileScan plugin as suggested ... vol.exe -f memdump.mem --profile=Win7SP1x64 --output=text --output-file=fileScan.txt filescan This resulted in the following line within my fileScan.txt file... 0x000000021d048800 3 1 R--r-- \Device\TrueCryptVolumeK\Test.txt I then ran Dumpfiles with the following command (using the physical address from the FileScan), but it did not result in any information... vol.exe -f memdump.mem --profile=Win7SP1x64 --output=text --output-file=dumpFiles_trueCryptFile.txt dumpfiles -Q 0x000000021d048800 -D dumps/ In looking at the above, I realized that the dumpfiles plugin doesn't require the --output-file parameter, so I re-ran the command as... vol.exe -f memdump.mem --profile=Win7SP1x64 -S dumpFiles_trueCryptFile2.txt dumpfiles -Q 0x000000021d048800 -D dumps/ With both dumpfiles attempts, the text file was blank and "output" directory empty. Both plugins completed quickly (within a couple seconds of processing). Does this mean that the information is not found in the memory? Or am I running this command in-correctly? Thank you, Rob On Mon, Apr 28, 2014 at 5:32 AM, Jamie Levy <jamie(a)memoryanalysis.net>wrote: