Hello Everyone,
I have been dumping memory on a few systems and when I go to process the
memory images I get different errors, some of these I think I've found
the answers but not sure on others.
Here are the errors I have seen:
procdump:
=======
Memory Not Accessible: Virtual Address: 0x4ad50000 File Offset: 0x50000
Size: 0x1000
pslist:
====
volatility_v1.3/forensics/win32/crashdump.py:31: DeprecationWarning: the
sha module is deprecated; use the hashlib module instead
import sha
*** Unable to load module malfind: No module named pydasm
*** Unable to load module malfind: No module named pydasm
datetime:
======
/volatility_v1.3/forensics/win32/crashdump.py:31: DeprecationWarning:
the sha module is deprecated; use the hashlib module instead
import sha
*** Unable to load module malfind: No module named pydasm
*** Unable to load module malfind: No module named pydasm
I believe the DeprecationWarning is due to the version of Python, which
is 2.6.2
The malfind module, not sure why I downloaded the module and have not
looked into it, however there should not be an issue, but there is.
Any Advice?
Thanks,
Robert