[取证] Volatility

docker pull cincan/volatility
docker run --rm -it cincan/volatility --info
docker run --rm -v /samples:/samples -it cincan/volatility imageinfo -f /samples/vol.vmem