there's ways of providing it to volatility as a JSON configuration file, but otherwise it's not clear that memory image can be analyzed properly. If you have other memory images, you could check that they work to make sure it isn't your installation (but there's nothing in the...
AccessData FTK Imager for converting data from the Encase format to a raw drive image CGSecurity Photorec for carving data from unallocated space A hex editor Note: Photorec is part of the TestDisk project, so you need to download the whole Testdisk package to access it. We used the 4Dell...