Re: [Vol-users] Can not use Volatility through Firewire

Hiya Sebastian, an option that was tried. That suggests that the firewire module couldn't locate either libforensic1394 (the preferred option and the only one that works with the juju stack) or libraw1394 (which only works with the old firewire stack). Since you've said you've had inception working (which relies on libforensic1394), my guess is that the module got installed in /usr/local/lib rather the /usr/lib, and it's possible that python can't find it by default but that inception can. You can check which modules volatility can see by running "python vol.py --info", and I suspect the "AddressSpaces" list won't contain FirewireAddressSpace as an entry. If you run python, and then try the command "import forensic1394", that will tell you whether python can find it or not. If you can an exception, then you'll have to figure out how to install it so that python can see it by default. If there's no error, then we'll need to look further into what's causing the problem. Also, I believe in the 2.3.1 release, it was a little temperamental because the delay between enabling the bus, setting it to sbp2 mode, and then trying to read data was too short. If you get it detecting firewire but having read problems, let me know and I'll walk you through applying a patch that might help. Mike 5:)