carlpulley/volatility — Issue #7: Memory mapped files have addressing errors
Author: carlpulley
Created: 2011-10-15 22:40:11+00:00
State: open

Memory mapped files (i.e. extracted filename matches direct.*) are stored against sector numbers. Currently, it looks like this is not being calculated correctly?

**Example:** work with Bob.vmem sample (from Honeynet challenge) and extract all pool files (survive the disk attack!). Compare PDF.php files memory mapped and shared cached pages, there's clearly a mismatch here!

Disabled file reconstruction for memory mapped files whilst the issue is worked upon.