A review of the Linux-capable version of volatility doesn't seem to indicate any option of performing a keyword search of captured memory. Is this correct? Also, I don't recall seeing an option in pmem.ko for capturing virtual/shared memory versus physical memory. Am I missing something? Thanks. Scott _______________________________________________ Vol-users mailing list Vol-users(a)volatilityfoundation.org http://lists.volatilityfoundation.org/mailman/listinfo/vol-users