case....
Adding link to Volatility memory dump
Made imagetype detection a bit more flexible to allow more types of XP and Win7