Memory analysis tools what do you expect?

I believe the EnCase EnScript "Memory Forensic Toolkit" Version 1.42 does much of this already - although it would be interesting to have a different tool & approach.

http//cci.cocolog-nifty.com/blog/2010/02/encase-enscri-1.html

Personally, I would like to have a tool that helps me extract the data being used by a process and export it in a form that I could easily open and examine. I've had a good amount of success exporting spreadsheets from process VAD dumps as well as extracting password hashes, but exporting web pages and cloud based documents (e.g. google docs & Microsoft office online) has been a bit messy. A tool that extracts the meta-data (e.g. google docs revision data) as well would be nice too. Again, I've had success carving it out but it's always nice to have a tool that makes it easier.

So that is my wish - a tool that does a nice job locating and extracting the data being used by a process. Oh yeah, and maybe a tool that extracts the registry files from a memory dump - if anyone knows how to do this with Volatility (e.g. using hivescan, hivelist, etc.) I'd love to know how.

EDIT - just found the registry extraction info http//www.slideshare.net/mooyix/sans-forensics-2009-memory-forensics-and-registry-analysis

I expect it to work just like volatility

https://www.volatilesystems.com/default/volatility

Actually, when you read the EnScript code, it mentions that it is essentially Volatility re-written for EnCase.

Interestingly, I've found that Volatility will occasionally work when the EnScript won't on some memory dumps.

Ideally id like to add support to auto-export reg hivs but to be honest ive not looked at that yet, so thank for mentioning it. as for auto-dumping process working memory/VAD etc.. ive been looking into that and hoping to have support for it finished soon.

Thank for your replys.

EDIT - just found the registry extraction info http//www.slideshare.net/mooyix/sans-forensics-2009-memory-forensics-and-registry-analysis

Thanks for posting that. It's just what I needed. I've been trying to do this for the last week.