$ ./f-response-tacex-lin.exe -s 192.168.1.129 -p 3260


# iscsiadm -m node -targetname=iqn.2008-02.com.f-response.cr0wn-d00e37654:disk-0 --login


# mount -o ro,show_sys_files,streams_interface=windows /dev/sdd1 /mnt/windows_mount


# dc3dd if=/dev/sde of=/cases/remote-system-memory8.img progress=on hash=md5 hashlog=/cases/remote-system-memory8.md5


$ vol.py -profile=WinXPSP2x86 pslist -f remote-system-memory8.img


$ vol.py -profile=WinXPSP2x86 psscan -f remote-system-memory8.img