Is it possible to access the contents of the clipboard?
Opened this issue · 1 comments
Tokeii0 commented
Is there a way to access the contents of the clipboard, similar to the Clipboard command in Volatility 2?
For instance, Windows 11 seems to cache some content in C:\Users{username}\AppData\Local\Microsoft\Windows\Clipboard.
I'm just curious if it's possible. I noticed Volatility 3 hasn't added this feature yet.
ufrisk commented
MemProcFS is sometimes able to recover recently open files if running in Forensics mode, you'll find these under M:\forensic\files\ROOT\
About the clipboard it's something I have to look into and research. Right now I'm a bit busy on working on some other new features and also fixes in other areas so it may be that there will be some time before I'm able to look into it.