I experienced one odd thing; when using the env variable VOLATILITY_LOCATION, volatility complains that &quot;No suitable address space mapping found&quot;, however when the file is specified on the command line, all is well.  Output below:<br>
<br>root@Forensic-1:/case2/mem# vol.py --dtb=0x187000 psscan<br>Volatile Systems Volatility Framework 2.1_rc1<br>Offset(P)          Name                PID   PPID PDB                Time created         Time exited<br>------------------ ---------------- ------ ------ ------------------ -------------------- --------------------<br>
No suitable address space mapping found   <br>Tried to open image as:<br> WindowsHiberFileSpace32: No base Address Space<br> WindowsCrashDumpSpace64: No base Address Space<br> WindowsCrashDumpSpace32: No base Address Space<br>
 AMD64PagedMemory: No base Address Space  <br> JKIA32PagedMemory: No base Address Space <br> JKIA32PagedMemoryPae: No base Address Space<br> IA32PagedMemoryPae: Module disabled<br> IA32PagedMemory: Module disabled<br> FileAddressSpace: Location is not of file scheme<br>
<br>root@Forensic-1:/case2/mem# echo $VOLATILITY_LOCATION<br>/case2/mem/myimage.vmss<br>root@Forensic-1:/case2/mem# unset VOLATILITY_LOCATION<br>root@Forensic-1:/case2/mem# vol.py --dtb=0x187000 psscan<br>Volatile Systems Volatility Framework 2.1_rc1<br>
ERROR   : __main__            : Please specify a location (-l) or filename (-f)<br>root@Forensic-1:/case2/mem# vol.py --dtb=0x187000 -f myimage.vmss psscan<br>Volatile Systems Volatility Framework 2.1_rc1<br>Offset(P)          Name                PID   PPID PDB                Time created         Time exited<br>
------------------ ---------------- ------ ------ ------------------ -------------------- --------------------<br>0x0000000006107040 System                4      0 0x0000000000187000 2012-04-12 07:14:16<br>0x0000000006139b30 residentagent.     1248   1132 0x0000000128a0e000 2012-04-12 07:16:03<br>
0x00000000061ba900 msdtc.exe          2164    484 0x00000001199a8000 2012-04-12 07:16:37<br>&lt;snip&gt;<br><br><br><div class="gmail_quote">On Mon, Jul 16, 2012 at 9:45 AM, Michael Hale Ligh <span dir="ltr">&lt;<a href="mailto:michael.hale@gmail.com" target="_blank">michael.hale@gmail.com</a>&gt;</span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hey everyone, <div><br></div><div>The 2.1 RC1 downloads are now available [1]. Per the usual, there are zip and tar archives of the source code, a windows module installer, and a standalone windows executable (with python and all dependencies build-in). We ask that you test vigorously over the next 2 weeks, especially with any x64 images, and let us know via the issue tracker [2] if you run into any bugs. At the end of July, we&#39;ll announce the official release of 2.1. </div>

<div><br></div><div>Also, a lot of the documentation [3] has been updated, including the FAQ, command reference, features by plugin matrix, and roadmap, so that may be a useful resource to you when using 2.1. </div><div>
<br>
</div><div>Thank you very much! </div><div><br></div><div>[1]. <a href="http://code.google.com/p/volatility/downloads/list" target="_blank">http://code.google.com/p/volatility/downloads/list</a></div><div>[2]. <a href="http://code.google.com/p/volatility/issues/list" target="_blank">http://code.google.com/p/volatility/issues/list</a></div>

<div>[3]. <a href="http://code.google.com/p/volatility/w/list" target="_blank">http://code.google.com/p/volatility/w/list</a></div><div><br></div><div><br></div>
<br>_______________________________________________<br>
Vol-users mailing list<br>
<a href="mailto:Vol-users@volatilityfoundation.org">Vol-users@volatilesystems.com</a><br>
<a href="http://lists.volatilityfoundation.org/mailman/listinfo/vol-users" target="_blank">http://lists.volatilityfoundation.org/mailman/listinfo/vol-users</a><br>
<br></blockquote></div><br><br clear="all"><br>-- <br>Jesse Bowling<br><br><br>