Remove default values for MEMORY_IMAGE_FILE, VOLATILITY_PROFILE from SANS FOR508. Add a conditional step whereby if the VOLATILITY_PROFILE has not been set, we invoke vol.py imageinfo then parse the output to provide a "best guess" of the image type
Remove default values for MEMORY_IMAGE_FILE, VOLATILITY_PROFILE from SANS FOR508.
Add a conditional step whereby if the VOLATILITY_PROFILE has not been set, we invoke
vol.py imageinfo then parse the output to provide a "best guess" of the image type

z3ndrag0n/forensicator-fate,z3ndrag0n/forensicator-fate,z3ndrag0n/forensicator-fate