version=4
http://www.porcupine.org/forensics/tct.html memdump-(\d.*)\.tar\.gz
