I am about to forensics investigation of a linux physical memory. I have dumped an ARM Linux which the profile is not listed in Volatility, so I could find the process and the latest command using Hex Editor. here is the Question, how can I create Volatility profile, should I first find the offsets of the network connection, open ports , sockets..... then go for Volatility ? by the Hex Editor I could see some information in Memory Dump, is there anyone who can help me how can I find the rest. and is it necessary to find all the offsets and address space of each information before creating the Volatility profile?