| Tool | Method | |------|--------| | bulk_extractor | Carve ZIP signatures from raw dump | | volatility 3 ( windows.filescan ) | Find file objects, then dump with dumpfiles | | strings + grep "PK" | Quick manual inspection |
