vol.exe -f chall1.raw imageinfo
vol.exe -f chall1.raw --profile Win7SP1x86 pslist vol.exe -f chall1.raw cmdscan