vol -f memory.raw windows.info
vol -f memory.raw windows.filescan | grep -i "png\|jpg\|jpeg"
vol -f memory.raw windows.dumpfiles --virtaddr 0x918b76c517f0