volatilityfoundation/volatility — pull request #90 by iMHLv2 (2014-09-18 02:19:39+00:00)
Title: patching strings to work with non-raw memory images

the strings plugin has always required a raw memory dump, so that offsets in the file equal offsets in physical memory. this patch allows us to run strings on memory dumps in other formats, such as crash, virtualbox, etc.

it does not work on hibernation files still of course....