Skip to content

@scudette scudette released this Mar 2, 2019

This is the first release of the new refactored code. The following things are supported:

  • Split volumes (e.g. winpmem.exe -t -dd -o test.aff4 --split 10m -i c:\Windows\System32\* )
  • Directory volume (e.g. winpmem.exe -t -dd -o test/ )
  • Extracting from multiple AFF4 volumes (e.g. winpmem.exe -dd -e "*notepad*" -D . test.aff4* )
Assets 4
You can’t perform that action at this time.
You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session.