How to get the specific file(txt) with volatility?

Question

I tried to filescan,and I see the .txt I want to open.But how can I open the txt?

I am new with volatility,and I tried more than 6 hours to get the txt.I tried dumpfiles,but I finally get lots of files that does'nt match the file I want to get.

please,is there anybody who can help me? – Ltfall Oct 11 '19 at 15:52 — Ltfall, Oct 11 '19 at 15:52

score 0 · Answer 1 · answered Oct 20 '19 at 16:09

0

get the imagebaseadress of the file and run db(imagebaseadress) inside volshell you should see the contents

answered Oct 20 '19 at 16:09

Cv Nikhil

25
7

How to get the specific file(txt) with volatility?

1 Answers1