I’ve been plugging away through the other challenges, but this one is out of my experience. I’ve been working with the most common forensic tool and can view data, but I’m finding online documentation on the OUTPUT contradictory and confusing. Is there anyone out there that can answer a handful of direct questions to confirm my thought process is on track? I’ll owe you a cookie.
Anything for cookie 
I used Volatality.
Tip: If you wanted to hack someone via email, what will be your course of action?
Got it Awesome
Got it too! my first memory forensics challenge
Learned to love volatility 
Done!
Such an interesting challenge! Learned a lot!
Happy to help anyone if needed.