carlpulley/volatility — Issue #5: Implement page file extraction
Author: carlpulley
Created: 2011-10-11 17:24:13+00:00
State: open

If we have access to the page file (e.g. as specified on the Volatility command line), we should be able to add in paged out areas of memory when exporting data from _FILE_OBJECT's.

This is definitely possible for memory mapped files, and should(?) also be possible for shared caches?

Maybe this would all be better as a more general Volatility plugin for working with memory images and page files?