[Vol-users] No shimcache data found

Brian Keefer chort at effu.se
Wed Jun 19 11:30:25 CDT 2013

I look at mostly Win7/64 systems and have always found shimcache data in memory images before. In the last several weeks only about 50% of the images I looked at had it. I'm running a 2.3 alpha build from a month or two ago (have been all this time).

While not strictly a Volatility issue, could someone explain under what circumstances the data wouldn't be available? I'm not a Windows internals expert (yet, I have part 1 and part 2 on my bookshelf, waiting...)



More information about the Vol-users mailing list