[Vol-users] Problem converting hiberfil.sys

Christian Herndler christian at herndler.com
Wed Nov 17 01:55:24 CST 2010


I tried to convert a hiberfil.sys from WindowsXP SP0 German and get the
following error:

/volatility hibinfo -f /tmp/hiberfil.sys -d /tmp/hiberfil.dd
Traceback (most recent call last):
  File "./volatility", line 219, in <module>
  File "./volatility", line 212, in main
    modules[argv[1]].execute(argv[1], argv[2:])
  File "/opt/Volatility/vmodules.py", line 62, in execute
    self.cmd_execute(module, args)
  File "/opt/Volatility/vmodules.py", line 1616, in hibinfo
    hiberAS = WindowsHiberFileSpace32(fileAS,0,0)
  File "/opt/Volatility/forensics/win32/hiber_addrspace.py", line 146,
in __init__
    for i in range(0,EntryCount):
OverflowError: range() result has too many items

any ideas ?


More information about the Vol-users mailing list