Finders Keepers

This was a fun forensics challenge.

You're given a ~300mb zip file which when unzipped contains two files.

1) Windows 7 .vmem file
2) bsides.KDBX

Google 'KDBX', its a Keepass 2.x safe file.

So presumably the challenge is to find the password to the safe file somewhere in memory.

Grep through the .vmem looking for 'password'.

$ grep -a password *.vmem > things

Lucky us, theres a string hidden in here:

Using keepass 2.x you can import the password safe and unmask the password to reveal the answer.

Many thanks to @bsjtf for the fun challenges :)