Bulk Extractor Using this tool, we will extract data from memory and then analysis during linux or windows IR activities. As a prerequisite, we need a memory image. For example our memory image name is ubuntu.20211208.mem.gz Someday we will show how to capture memory images using avml or lime tool or other. See my medium writeup. From your linux forensic machine, run following commands: gunzip /images/All-Images/HudaksHoneypot/ ubuntu.20211208.mem.gz Now you will have this file - ubuntu.20211208.mem Now we will use bulk extractor tool. This tool available in kali and sans forensics machine as well. bulk_extractor -o be-output /images/All-Images/HudaksHoneypot/ubuntu.20211208.mem (Remember be-output directory should not be created early. This tool will create this directory on its own) You will see various files captured and extracted by this tool. Now we will also use strings command in order to facilitate our IR work later. strings -a -t d /i...