Posts tagged "memory-forensics"

• Volatility and Amcache: extracting the hive from memory images

  When you only have a RAM dump, Volatility extracts the in-memory copy of Amcache.hve. Hand off to AmcacheParser. The cases where this is the only option.

  2026-05-24