pdfimages image.pdf img.ppm
python3 depix.py \
-p image.ppm \
-s images/searchimages/debruinseq_notepad_Windows10_closeAndSpaced.png
steghide extract -sf image.jpg
foremost -i image.png
strings file
exiftool file
binwalk -e file
python vol.py -f image.dmp windows.info
python vol.py -f image.dmp windows.pslist
python vol.py -f image.dmp windows.psscan
python vol.py -f image.dmp windows.pstree
python vol.py -f image.dmp windows.cmdline
python vol.py -f image.dmp windows.netstat
python vol.py -f image.dmp windows.netscan
python vol.py -f image.dmp windows.dumpfiles ‑‑pid <PID>
python vol.py -f image.dmp -o output windows.memmap --dump ‑‑pid <PID>