Re: [Vol-users] Win 2008 Enterprise Server SP1 Errors

psscan, modscan, driverscan, filescan, mutantscan, symlinkscan, thrdscan, and netscan produced no output other than the header. impscan, svcscan, and cmdscan all returned errors. hivescan returned a bunch of offsets with no other info: C:\Users\student\Desktop\Volatility>volatility-2.1.standalone.exe -f G:\FIWE-Scenarios\Final\AD\RAM\10010AD.dd --profile=VistaSP1x86 --kdbg=0x8193ec90 cmdscan Volatile Systems Volatility Framework 2.1 Traceback (most recent call last): File "<string>", line 185, in <module> File "<string>", line 176, in main File "C:\volatility\build\pyi.win32\pyinstaller\vol.pkz\volatility.commands", line 111, in execute File "C:\volatility\volatility\plugins\malware\cmdhistory.py", line 670, in render_text File "C:\volatility\volatility\plugins\malware\cmdhistory.py", line 656, in calculate File "C:\volatility\volatility\plugins\malware\cmdhistory.py", line 624, in cmdhistory_process_filter File "C:\volatility\build\pyi.win32\pyinstaller\vol.pkz\volatility.win32.tasks", line 72, in pslist File "C:\volatility\volatility\plugins\overlays\windows\kdbg_vtypes.py", line 40, in processes AttributeError: Could not list tasks, please verify your --profile with kdbgscan C:\Users\student\Desktop\Volatility>volatility-2.1.standalone.exe -f G:\FIWE-Scenarios\Final\AD\RAM\10010AD.dd --profile =VistaSP1x86 --kdbg=0x8193ec90 hivescan Volatile Systems Volatility Framework 2.1 Offset(P) ---------- 0x00553008 0x01ca9008 0x01d09008 0x0cbea008 0x4072b008 0x48c31008 0x4cdfa008 0x4f4ee008 0x53217850 0x5841d008 0x62aa0008 0x6dc6a850 0x7d5a6850 C:\Users\student\Desktop\Volatility>volatility-2.1.standalone.exe -f G:\FIWE-Scenarios\Final\AD\RAM\10010AD.dd --profile =VistaSP1x86 --kdbg=0x8193ec90 svcscan Volatile Systems Volatility Framework 2.1 Traceback (most recent call last): File "<string>", line 185, in <module> File "<string>", line 176, in main File "C:\volatility\build\pyi.win32\pyinstaller\vol.pkz\volatility.commands", line 111, in execute File "C:\volatility\volatility\plugins\malware\svcscan.py", line 307, in render_text File "C:\volatility\volatility\plugins\malware\svcscan.py", line 271, in calculate File "C:\volatility\build\pyi.win32\pyinstaller\vol.pkz\volatility.win32.tasks", line 72, in pslist File "C:\volatility\volatility\plugins\overlays\windows\kdbg_vtypes.py", line 40, in processes AttributeError: Could not list tasks, please verify your --profile with kdbgscan C:\Users\student\Desktop\Volatility>volatility-2.1.standalone.exe -f G:\FIWE-Scenarios\Final\AD\RAM\10010AD.dd --profile =VistaSP1x86 --kdbg=0x8193ec90 impscan Volatile Systems Volatility Framework 2.1 IAT Call Module Function ---------- ---------- -------------------- -------- Traceback (most recent call last): File "<string>", line 185, in <module> File "<string>", line 176, in main File "C:\volatility\build\pyi.win32\pyinstaller\vol.pkz\volatility.commands", line 111, in execute File "C:\volatility\volatility\plugins\malware\impscan.py", line 361, in render_text File "C:\volatility\volatility\plugins\malware\impscan.py", line 253, in calculate File "C:\volatility\build\pyi.win32\pyinstaller\vol.pkz\volatility.win32.tasks", line 72, in pslist File "C:\volatility\volatility\plugins\overlays\windows\kdbg_vtypes.py", line 40, in processes AttributeError: Could not list tasks, please verify your --profile with kdbgscan On Wed, Aug 22, 2012 at 1:02 PM, Jamie Levy &lt;jamie.levy(a)gmail.com&gt; wrote: