In a comment on my article Volatility, my own cheatsheet (Part 3): Process Memory, Fabrizio asked me: […] da un dump di memoria su un sistema win7, ho rilevato che era in esecuzione notepad, è possibile visualizzarne il contenuto? ([…] from a memory dump on a win7 system, I found out that notepad was running, can…
Article Link: https://andreafortuna.org/dfir/volatility-tips-extract-text-typed-in-a-notepad-window-from-a-windows-memory-dump/