9:52 p.m.
I am using WIN XP SP 2, python 2.6.2 and the 1.3 beta of volatility. I can
get all the scripts to work just fine except those that require a dump. I
am trying to dump the mods out of memory using the following syntax:
python volatility moddump -f /c/memory.img > /f/dumps
I have also tried with the backslash and forward slash but I either get the
error:
"File exists" or "Access Denied"
Any help would be appreciated.
Mark Morgan
DOE/CIRC
Las Vegas, NV
10:57 p.m.
Hey Mark,
Thanks for the email. The Volatility team appreciates all feedback and we
welcome any questions you may have.
What operating system are you using as your analysis platform? Have you
tried specifying an output directory (-d)?
Can you clarify what you mean "except those that require a dump"? What
commands are giving you trouble?
Thanks,
AW
On Sun, 26 Jul 2009, Mark Morgan wrote:
I am using WIN XP SP 2, python 2.6.2 and the 1.3 beta
of volatility. I can
get all the scripts to work just fine except those that require a dump. I
am trying to dump the mods out of memory using the following syntax:
python volatility moddump -f /c/memory.img > /f/dumps
I have also tried with the backslash and forward slash but I either get the
error:
"File exists" or "Access Denied"
Any help would be appreciated.
Mark Morgan
DOE/CIRC
Las Vegas, NV
10:07 a.m.
Hi!
Does any body knows of good acquisition utilities so I can use??
I'm starting in this field, so i don't know of any. Best regards.
On Sun, Jul 26, 2009 at 9:57 PM, AAron Walters <awalters(a)4tphi.net> wrote:
Hey Mark,
Thanks for the email. The Volatility team appreciates all feedback and we
welcome any questions you may have.
What operating system are you using as your analysis platform? Have you
tried specifying an output directory (-d)?
Can you clarify what you mean "except those that require a dump"? What
commands are giving you trouble?
Thanks,
AW
On Sun, 26 Jul 2009, Mark Morgan wrote:
I am using WIN XP SP 2, python 2.6.2 and the 1.3 beta of volatility. I
--
Miguel Guirao A
can
get all the scripts to work just fine except those that require a dump. I
am trying to dump the mods out of memory using the following syntax:
python volatility moddump -f /c/memory.img > /f/dumps
I have also tried with the backslash and forward slash but I either get
the
error:
"File exists" or "Access Denied"
Any help would be appreciated.
Mark Morgan
DOE/CIRC
Las Vegas, NV
_______________________________________________
Vol-users mailing list
Vol-users(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
5:31 p.m.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
win32dd of course ! :D
http://win32dd.msuiche.net/
seriously, Win32dd is one among others, but it works like a charm.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.12 (MingW32)
Comment: Use GnuPG with Firefox : http://getfiregpg.org (Version: 0.7.6)
iQEcBAEBCgAGBQJKbhzDAAoJEKIiDOJfGe5KkPgH/2VMlA6hJg8eh/FS49IuIsO2
+MfVWnHMmoxZEOmMznjY91pEcDErFfNVN2EjuBL8nSsXir6KeX6duCYy0434/xHh
VIbvGVQ+9qmQCOJuPHaDM7y77pST5VfAQkgzAHFG3pI56iY3El6DmOUEF/P1/9Zc
qKFGkdAp6w1SiNAie/A7e1ZtcSoNYJBeJL1t2CHfHu9C69JDR2CBNGJ0ax6kylF0
DLaZXpuDJYBYizbBy6dqLQr7vIu1aa4tI/jWJOXYEvHcFeuklBSOAYRPV0VCBZRv
8OSoQuYOnhSgPoHsHlB3MEoCdgwFUP5MlHNtdFw7/kvzbys3h059TKhusVNOYiE=
=3BRh
-----END PGP SIGNATURE-----
2009/7/27 Miguel Guirao <mguirao(a)gmail.com>:
Hi!
Does any body knows of good acquisition utilities so I can use??
I'm starting in this field, so i don't know of any. Best regards.
On Sun, Jul 26, 2009 at 9:57 PM, AAron Walters <awalters(a)4tphi.net> wrote:
Hey Mark,
Thanks for the email. The Volatility team appreciates all feedback and we
welcome any questions you may have.
What operating system are you using as your analysis platform? Have you
tried specifying an output directory (-d)?
Can you clarify what you mean "except those that require a dump"? What
commands are giving you trouble?
Thanks,
AW
On Sun, 26 Jul 2009, Mark Morgan wrote:
--
Miguel Guirao A
_______________________________________________
Vol-users mailing list
Vol-users(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
I am using WIN XP SP 2, python 2.6.2 and the 1.3
beta of volatility. I
can
get all the scripts to work just fine except those that require a dump.
I
am trying to dump the mods out of memory using the following syntax:
python volatility moddump -f /c/memory.img > /f/dumps
I have also tried with the backslash and forward slash but I either get
the
error:
"File exists" or "Access Denied"
Any help would be appreciated.
Mark Morgan
DOE/CIRC
Las Vegas, NV
_______________________________________________
Vol-users mailing list
Vol-users(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users 
4:39 p.m.
Hi,
Based on a quick look, I think your problem is that you are trying to
redirect the output of the command into a directory. Moddump dumps kernel
modules to the current directory. Give the command a try without the ">
/f/dumps"; it should produce files named driver.[address].sys in the
current directory.
-Brendan
Hey Mark,
Thanks for the email. The Volatility team appreciates all feedback and we
welcome any questions you may have.
What operating system are you using as your analysis platform? Have you
tried specifying an output directory (-d)?
Can you clarify what you mean "except those that require a dump"? What
commands are giving you trouble?
Thanks,
AW
On Sun, 26 Jul 2009, Mark Morgan wrote:
I am using WIN XP SP 2, python 2.6.2 and the 1.3
beta of volatility. I
can
get all the scripts to work just fine except those that require a dump.
I
am trying to dump the mods out of memory using the following syntax:
python volatility moddump -f /c/memory.img > /f/dumps
I have also tried with the backslash and forward slash but I either get
the
error:
"File exists" or "Access Denied"
Any help would be appreciated.
Mark Morgan
DOE/CIRC
Las Vegas, NV
_______________________________________________
Vol-users mailing list
Vol-users(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
5651
days inactive
5651
days old
vol-users@lists.volatilityfoundation.org
4 comments
5 participants
participants (5)
-
AAron Walters -
bdolangavitt＠wesleyan.edu -
Mark Morgan -
Miguel Guirao -
Sebastien R