Hello all,
finally I found time to test the new version 2.0. It looks great even if I
became familiar with the old structure.
I tried to use it on an 64Bit-Win7 with Python64. This seems not to work but
after installing the x(86)-architecture it does.
However when starting v2.0 with I get the following error message:
*** Failed to import volatility.plugins.registry.lsadump (ImportError: DLL
load failed: %1 ist keine zulõssige Win32-Anwendung [transl.: %1 is no valid
win32 application]
What went wrong?
Regards
Michael
Mike - thanks so much for replying
***************************************************************************************************
This is the terminal output for the lipo commands:
qbl-mbp:~ qubyte$ lipo -info /usr/local/lib/libewf.dylib
Non-fat file: /usr/local/lib/libewf.dylib is architecture: x86_64
qbl-mbp:~ qubyte$ lipo -info `which python`
Architectures in the fat file:
/Library/Frameworks/Python.framework/Versions/2.6/bin/python are: ppc i386
***************************************************************************************************
Output from from the versioner command:
qbl-mbp:volatility2.0 qubyte$ VERSIONER_PYTHON_PREFER_32_BIT=yes python
vol.py -h
Volatile Systems Volatility Framework 2.0
*** Failed to import volatility.plugins.addrspaces.ewf (OSError:
dlopen(/usr/local/lib/libewf.dylib, 6): no suitable image found. Did find:
/usr/local/lib/libewf.dylib: mach-o, but wrong architecture)
I have also cc'd Joachim Metz on this in case he has some insight. Joachim
- in case you have time to read this i am encountering this error with
libewf and volatility 2.0 when running volatitlity (mac ox 10.6.8 with
libewf 20100226; this version of libewf is used to due to TSK 3.2.2):
*** Failed to import volatility.plugins.addrspaces.ewf (OSError:
dlopen(/usr/local/lib/libewf.dylib, 6): no suitable image found. Did find:
/usr/local/lib/libewf.dylib: mach-o, but wrong architecture)
Thanks to the vol group and joachim for taking the time to read this! I
look forward to the next set of ideas! :)
Cheers
Shafik
On Tue, Aug 9, 2011 at 11:00 AM, <vol-users-request(a)volatilityfoundation.org>wrote:
> lipo -info `which python`
Hello List!
I have been fighting with this issue since volatility 1.4 RC1. I am not
able to figure out why it cannot locate the correct libewf library. I have
uninstalled and reinstalled from source the libewf 20100226 stable version.
Can anyone assist me with this
Terminal output:
qbl-mbp:volatility2.0 qubyte$ python vol.py -h
Volatile Systems Volatility Framework 2.0
*** Failed to import volatility.plugins.addrspaces.ewf (OSError:
dlopen(/usr/local/lib/libewf.dylib, 6): no suitable image found. Did find:
/usr/local/lib/libewf.dylib: mach-o, but wrong architecture)
Usage: Volatility - A memory forensics analysis platform.
OS: Mac OS X 10.6.8
Python:
qbl-mbp:~ qubyte$ python
Python 2.6.6 (r266:84374, Aug 31 2010, 11:00:51)
[GCC 4.0.1 (Apple Inc. build 5493)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
>>>
Any help would be greatly appreciated...and please dont assume that I know
my well around terminal shell..I am still a newbie and learning lots!
Thanks!
Shafik
__________________________________
Shafik Punja
BSc, A+, CISSP, Network+, ACE, CCE
Senior Technical Officer
*QuByte Logic Ltd*
612-500 Country Hills Blvd NE, Suite #404
Calgary, AB CANADA T3K 5K3
ph: 403.909.6120
em: shafghp(a)gmail.com or shafik(a)qubytelogic.com
wp: http://www.qubytelogic.com
