[Vol-dev] A few questions

Greetings, This looks to be where the cool kids are hanging out these days, so I thought I would pop in. I'm just getting familiar with Volatility, and I think the project is a great idea. I plan on following it closely and hope to contribute code/debugging in the future. However, I have run in to a problem. I'm trying to get familiar with the tools using the Windows XP images available in: http://www.cfreds.nist.gov/mem/memory-images.rar When I run things like: python volatility datetime -f xp-laptop-2005-07-04-1430.img python volatility pslist -f xp-laptop-2005-07-04-1430.img I get the following: Traceback (most recent call last): File "/usr/local/src/Volatility-1.1.1/volatility", line 143, in <module> main() File "/usr/local/src/Volatility-1.1.1/volatility", line 139, in main modules[argv[1]].execute(argv[1], argv[2:]) File "/usr/local/src/Volatility-1.1.1/vmodules.py", line 54, in execute self.cmd_execute(module, args) File "/usr/local/src/Volatility-1.1.1/vmodules.py", line 108, in get_datetime (addr_space, symtab, types) = load_and_identify_image(op, opts) File "/usr/local/src/Volatility-1.1.1/vutils.py", line 152, in load_and_identify_image dtb = guess_dtb(filename, op) File "/usr/local/src/Volatility-1.1.1/vutils.py", line 69, in guess_dtb dtb = find_dtb(flat_address_space, types) File "/usr/local/src/Volatility-1.1.1/forensics/win32/tasks.py", line 104, in find_dtb return process_dtb(addr_space, types, offset) File "/usr/local/src/Volatility-1.1.1/forensics/win32/tasks.py", line 138, in process_dtb ['_EPROCESS', 'Pcb', 'DirectoryTableBase', 0], task_vaddr) File "/usr/local/src/Volatility-1.1.1/forensics/object.py", line 168, in read_obj return read_value(addr_space, current_type, vaddr + offset) File "/usr/local/src/Volatility-1.1.1/forensics/object.py", line 70, in read_value (val, ) = struct.unpack(type_unpack_char, buf) File "/usr/lib/python2.5/struct.py", line 87, in unpack return o.unpack(s) struct.error: unpack requires a string argument of length 8 Since I'm running Volatility 1.1.1, I'd guess that this may have already been fixed in 1.2.* or 1.3.*. I've read through all of the mailing list archives and scoured your project site, but I can't seem to find those newer versions for download. Perhaps I'm just totally missing something. Could someone point me in the right direction to get the latest version? SVN or other development repository would be fine, I don't mind messing with bleeding edge stuff. The second reason for my post is that I'll be giving an introductory training course on incident response and digital forensics next month, and I had considered introducing students to volatility and other memory analysis tools. Do you folks have suggestions as to which features of volatility would be the best to showcase in that type of setting? thanks, tim