Be notified of new releases
Create your free GitHub account today to subscribe to this repository for new releases and build software alongside 31 million developers.Sign up
This is the first release of the new refactored code. The following things are supported:
- Split volumes (e.g.
winpmem.exe -t -dd -o test.aff4 --split 10m -i c:\Windows\System32\*)
- Directory volume (e.g.
winpmem.exe -t -dd -o test/)
- Extracting from multiple AFF4 volumes (e.g.
winpmem.exe -dd -e "*notepad*" -D . test.aff4*)