carlpulley/volatility — Issue #8: Improve _FILE_OBJECT extraction
Author: carlpulley
Created: 2011-10-16 23:58:15+00:00
State: open
Labels: Bug

Currently, _FILE_OBJECT's with empty file names are not extracted (even if they have extractable data?).

_FILE_OBJECT's can end up with empty names due to the way that _UNICODE_STRING deals with filenames of length > 1024.

In these cases, we should still be extracting the _FILE_OBJECT data, but we should dump it into a directory named with the _FILE_OBJECT's address.