Extracting data from start and end addresses in memory.

Hello all!

I’ve hit a wall with volatility and am looking for advice on what I should do next. So far I have used the unloadedmodules plugin in volatility and have noticed some unloaded .sys files I want to carve out and analyze further. The plug-in displays the start and end address of the file in memory, but how do I use this information in volatility to carve out that section in memory? Any help would be greatly appreciated and …

computerforensics data end memory start