carlpulley/volatility — Issue #9: Allow saving of extraction of _FILE_OBJECT's to a file system image
Author: carlpulley
Created: 2011-10-17 07:51:58+00:00
State: open
Labels: Enhancement

If we were to save _FILE_OBJECT's to a fresh image file (e.g. *.img or *.dmg), then we might be able to use standard file forensic tools (e.g. Sleuthkit via pytsk?) to then analyse the extracted memory view of the file system.