[Vol-dev] RE: My Mistakes & Documentation Suggestions

Hi Folks, Thanks tons to Mike Auty, Andrew Case, Joe Sylve, Andrew DiMino, Michael Cohen, and Jamie Levy, I'm now up and running with Volatility for Linux. I did want to mention a couple of things that I ran into problems with. It's possible we might want for some related items to be more prominent in the documentation. 1. While the -h option output does include the line, "--info Print information about all registered objects", it still wasn't immediately clear to me that this option would list available profiles. In fact, I somehow managed to miss the existence of --info entirely. It might be useful to actually include the list of available profiles in the -h output. Alternatively, maybe we could move -info in the -h output closer to the top, & specifically mention that it will list available profiles? 2. It wasn't clear to me initially that to define a profile, you drop an appropriately named .zip file with appropriate contents into volatility/plugins. It's still not entirely clear, as from some of my reading it looks like you're supposed to put the profile file into volatility/plugins/overlays/<ostype> instead. I'm guessing both probably work, though I haven't tested. I suspect one is legacy or something. You might want to append a notation to the -profile line in the -h output to, "see the tools/<ostype>/README file for details on profile creation", and then spell this out a little more clearly there, including how the profile name is constructed, based on the name of the zip file. 3. I ran into a problem using the specific zip command listed in the tools/linux/README file, "zip Distro.zip module.dwarf /boot/System.map-2.6.32-8-generic". This creates a zip file with a boot subfolder containing the System.map file, which didn't work in my testing. I had to copy the System.map file to the current folder and then zip up the two files. 4. The linux wiki document is out of date, but I imagine you already knew that. It should refer to the linux-trunk branch instead of the scudette branch. It also doesn't say where to put the .zip file to create a profile, how the name of the new profile is created, based on the .zip file name, or how to get a list of available profiles. Thanks again John