Where would the virtual address be place in question Examine the output of “hivelist “ to find the virtual memory address at which this registry hive was loaded. example Run volatility hivedump - - output-file - -hivedump.txt - - hive-offset address (Substituting in the virtual memory address at the end).