Hello all, to test if the I/O packet size is the only problem I have adapted ieee1394.py in that way: def read(self, addr, length): """Lowering packet size""" self._device.request_size = 1024 """Reads bytes from the specified address""" return self._device.read(addr, length) So there's no I/O error reported by forensic 1394 anymore but the data seems to be not mappable: # python vol.py -l firewire://forensic1394/0 pslist Volatile Systems Volatility Framework 2.1_alpha No suitable address space mapping found Tried to open image as: ... FirewireAddressSpace: Must be first Address Space FileAddressSpace: Must be first Address Space I have no clue what went wrong. Any help appreciated... CU Michael -- NEU: FreePhone - 0ct/min Handyspartarif mit Geld-zurück-Garantie! Jetzt informieren: http://www.gmx.net/de/go/freephone