Try adding "-arch x86_64" when building libewf.

> mac ox 10.6.8 with libewf 20100226; this version of libewf is used to due to TSK 3.2.

FYI I've there are patches available on the TSK trackers to have TSK also support newer alphas of libewf.

Joachim

On Wed, Aug 10, 2011 at 05:38, Shafik Punja <shafghp@gmail.com> wrote:

Mike - thanks so much for replying

***************************************************************************************************

This is the terminal output for the lipo commands:

qbl-mbp:~ qubyte$ lipo -info /usr/local/lib/libewf.dylib
Non-fat file: /usr/local/lib/libewf.dylib is architecture: x86_64
qbl-mbp:~ qubyte$ lipo -info `which python`
Architectures in the fat file: /Library/Frameworks/Python.framework/Versions/2.6/bin/python are: ppc i386

***************************************************************************************************

Output from from the versioner command:

qbl-mbp:volatility2.0 qubyte$ VERSIONER_PYTHON_PREFER_32_BIT=yes python vol.py -h

Volatile Systems Volatility Framework 2.0
*** Failed to import volatility.plugins.addrspaces.ewf (OSError: dlopen(/usr/local/lib/libewf.dylib, 6): no suitable image found. Did find:
/usr/local/lib/libewf.dylib: mach-o, but wrong architecture)

I have also cc'd Joachim Metz on this in case he has some insight. Joachim - in case you have time to read this i am encountering this error with libewf and volatility 2.0 when running volatitlity (mac ox 10.6.8 with libewf 20100226; this version of libewf is used to due to TSK 3.2.2):

*** Failed to import volatility.plugins.addrspaces.ewf (OSError: dlopen(/usr/local/lib/libewf.dylib, 6): no suitable image found. Did find:
/usr/local/lib/libewf.dylib: mach-o, but wrong architecture)

Thanks to the vol group and joachim for taking the time to read this! I look forward to the next set of ideas! :)

Cheers

Shafik

On Tue, Aug 9, 2011 at 11:00 AM, <vol-users-request@volatilityfoundation.org> wrote:
lipo -info `which python`