数字取证-内存取证(volatility)
基础操作 查看帮助文件 volatility_2.6_win64_standalone.exe -h 内存镜像信息 volatility_2.6_win64_standalone\volatility_2.6_win64_standalone>volatility_2.6_win64_standalone.exe -f "C:\Users\xx\Desktop\victor_PC_memdump.dmp" imageinfo 查看账户 …
2025-09-19