Is it possible to access the contents of the clipboard?

ufrisk / MemProcFS

MemProcFS

GNU Affero General Public License v3.0

3.14k stars 382 forks source link

Is it possible to access the contents of the clipboard? #335

Open Tokeii0 opened 2 weeks ago

Tokeii0 commented 2 weeks ago

Is there a way to access the contents of the clipboard, similar to the Clipboard command in Volatility 2? For instance, Windows 11 seems to cache some content in C:\Users{username}\AppData\Local\Microsoft\Windows\Clipboard. I'm just curious if it's possible. I noticed Volatility 3 hasn't added this feature yet.

ufrisk commented 1 week ago

MemProcFS is sometimes able to recover recently open files if running in Forensics mode, you'll find these under M:\forensic\files\ROOT\

About the clipboard it's something I have to look into and research. Right now I'm a bit busy on working on some other new features and also fixes in other areas so it may be that there will be some time before I'm able to look into it.