C:\Micha\Forensics\Volatility>python volatility hivescan -f"d:\RAM-Analyse\Dateien aus RipperXPHDD\Hiberfil RipperXP dec
ompressed"
C:\Micha\Forensics\Volatility\forensics\win32\crashdump.py:31: DeprecationWarning: the sha module is deprecated; use the
 hashlib module instead
  import sha
c:\Python\lib\site-packages\Crypto\Hash\MD5.py:6: DeprecationWarning: the md5 module is deprecated; use hashlib instead
  from md5 import *
Offset          (hex)
45096968        0x2b02008
45124448        0x2b08b60
50341720        0x3002758
86700040        0x52af008
177039216       0xa8d6770
217930592       0xcfd5b60
217971552       0xcfdfb60
257265672       0xf559008
260180832       0xf820b60
261110624       0xf903b60
265877888       0xfd8f980
283994976       0x10ed6b60
363088736       0x15a44b60

C:\Micha\Forensics\Volatility>python volatility hivelist -o 0x2b02008 -f"d:\RAM-Analyse\Dateien aus RipperXPHDD\Hiberfil
 RipperXP decompressed"
C:\Micha\Forensics\Volatility\forensics\win32\crashdump.py:31: DeprecationWarning: the sha module is deprecated; use the
 hashlib module instead
  import sha
c:\Python\lib\site-packages\Crypto\Hash\MD5.py:6: DeprecationWarning: the md5 module is deprecated; use hashlib instead
  from md5 import *
Address      Name
0xe1e68b60   \Dokumente und Einstellungen\ripper\Lokale Einstellungen\Anwendungsdaten\Microsoft\Windows\UsrClass.dat
0xe1fb7b60   \Dokumente und Einstellungen\ripper\NTUSER.DAT
0xe1c20980   \Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\Microsoft\Windows\UsrClass.d
at
0xe1bfdb60   \Dokumente und Einstellungen\LocalService\NTUSER.DAT
0xe1bebb60   \Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\Microsoft\Windows\UsrClass
.dat
0xe1bdc008   \Dokumente und Einstellungen\NetworkService\NTUSER.DAT
0xe170eb60   \WINDOWS\system32\config\software
0xe17d9008   \WINDOWS\system32\config\default
0xe1a4b770   \WINDOWS\system32\config\SECURITY
0xe1701b60   \WINDOWS\system32\config\SAM
0xe152b758   [no name]
0xe1035b60   \WINDOWS\system32\config\system
0xe102e008   [no name]

C:\Micha\Forensics\Volatility>python volatility hashdump -s 0xe1701b60 -y 0xe1035b60 -f"d:\RAM-Analyse\Dateien aus Rippe
rXPHDD\Hiberfil RipperXP decompressed"
C:\Micha\Forensics\Volatility\forensics\win32\crashdump.py:31: DeprecationWarning: the sha module is deprecated; use the
 hashlib module instead
  import sha
c:\Python\lib\site-packages\Crypto\Hash\MD5.py:6: DeprecationWarning: the md5 module is deprecated; use hashlib instead
  from md5 import *
Traceback (most recent call last):
  File "volatility", line 219, in <module>
    main()
  File "volatility", line 215, in main
    command.execute()
  File "memory_plugins\registry/hashdump.py", line 78, in execute
    dump_memory_hashes(addr_space, types, self.opts.syshive, self.opts.samhive, prof)
  File "C:\Micha\Forensics\Volatility\forensics\win32\hashdump.py", line 305, in dump_memory_hashes
    dump_hashes(sysaddr, samaddr, profile)
  File "C:\Micha\Forensics\Volatility\forensics\win32\hashdump.py", line 289, in dump_hashes
    bootkey = get_bootkey(sysaddr,profile)
  File "C:\Micha\Forensics\Volatility\forensics\win32\hashdump.py", line 131, in get_bootkey
    class_data = sysaddr.read(key.Class, key.ClassLength)
AttributeError: 'NoneType' object has no attribute 'Class'