Replies: 1 comment
-
|
Please disregard. I found I can just run : memprocfs -device mem.dmp -forensic 4 and wait for the forensics to finish which creates timeline_all under \forensic\csv\timeline |
Beta Was this translation helpful? Give feedback.
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
Hi.
I enjoy your tool but what functions do I have to run only to produce "timeline_all.csv"?
Thanks!
Beta Was this translation helpful? Give feedback.
All reactions