[Vol-users] libewf on Windows (I know, I know!)

Bridgey theGeek bridgeythegeek at gmail.com
Tue Aug 16 09:39:34 CDT 2016


Hi all,

Because the universe hates me, I've been given an E01 of a RAM dump (from
Win7SP1x64) and I have to use Windows to run Volatility.

I have p99 of tAoMF in front of me.

I tried the "Mount in FTK Imager and point to Z:\unallocated space" thing,
but pslist showed only 1 entry which looked very corrupt.

I don't have access to EnCase to mount it from there.

So I'd like to use libewf. But can I even use it on Windows?? If I compile
the library, how do I tell Volatility about the libewf.dll?


Basically, how do I use Volatility with libewf on Windows?

Thank you,
Adam
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.volatilityfoundation.org/pipermail/vol-users/attachments/20160816/73e7b19d/attachment.html


More information about the Vol-users mailing list