Hello guys,
I'm trying to use Volatility through Firewire, but actually it's not
working.
My investigator PC runs Ubuntu Linux Ubuntu 12.04
I'm using the New (JuJu) Firewire stack compiled into kernel and I also
installed forensic1394.
My Firewire Bus is up and connected to a Firewire Bus on a target win7
system (4GB memory),
I can successfully dump the memory with another tool called 'inception'.
However, output only says:
vol# python vol.py -l firewire://forensic1394/0 --profile=Win7SP1x64 modules
Volatility Foundation Volatility Framework 2.3.1
No suitable address space mapping found
Tried to open image as:
MachOAddressSpace: mac: need base
LimeAddressSpace: lime: need base
WindowsHiberFileSpace32: No base Address Space
WindowsCrashDumpSpace64: No base Address Space
HPAKAddressSpace: No base Address Space
VirtualBoxCoreDumpElf64: No base Address Space
VMWareSnapshotFile: No base Address Space
WindowsCrashDumpSpace32: No base Address Space
AMD64PagedMemory: No base Address Space
IA32PagedMemoryPae: No base Address Space
IA32PagedMemory: No base Address Space
FileAddressSpace: Location is not of file scheme
ArmAddressSpace: No base Address Space
What I am doing wrong?
Thank you!
--
Sebastian