[Vol-users] Error with 2.4 Debian Wheezy

Sean McLinden mclinden at informed.net
Thu Sep 25 08:57:13 CDT 2014


I just build a VM with Debian (I needed to install other packages) and when I run this on a memory image I get the following (after about 10 minutes). The pslist.txt file is partially populated though how far it gets differs with each run.

The box is Windows 7 Enterprise SP 1. The image was acquired using FTK. The box is believed to be infected with malware.

user at host:/mnt/hgfs/288A-LV-2810395/Workspace/QJK1/memory# vol.py pslist > pslist.txt
Volatility Foundation Volatility Framework 2.4
Traceback (most recent call last):
  File "/usr/local/bin/vol.py", line 192, in <module>
    main()
  File "/usr/local/bin/vol.py", line 183, in main
    command.execute()
  File "/usr/local/lib/python2.7/dist-packages/volatility/commands.py", line 127, in execute
    func(outfd, data)
  File "/usr/local/lib/python2.7/dist-packages/volatility/plugins/taskmods.py", line 178, in render_text
    str(task.ExitTime or ''),
  File "/usr/local/lib/python2.7/dist-packages/volatility/commands.py", line 219, in table_row
    outfd.write(self.tablesep.join(reslist) + "\n")
IOError: [Errno 22] Invalid argument

Thanks for any help.

Sean McLinden


More information about the Vol-users mailing list