Description
An excerpt of a memory dump extracted by Access Data’s FTK Imager (memdump.bin) has been provided.
1) Copy the memory dump to the virtual desktop environment persistent storage area.
2) Develop a python script and regular expressions to extract and report ALL the emails and urls found in the memory dump. Additionally, identify strings of 5-15 characters.
REGULAR EXPRESSIONS HELP
ePatt = re.compile(b'[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+.[A-Za-z]{2,4}’)
uPatt = re.compile(b’w+://[w@][w.:@]+/?[w..?=%&=-@$,]*’)
wPatt = re.compile(b'[a-zA-Z]{5,15}’)