Word.
The purpose of imageinfo is you help you pick a profile to use for an
unknown memory dump. Since you already know its Win7 32bit you can just
supply --profile=Win7SP0x86 (or Win7SP1x86) and everything will be super
quick.
MHL
On Tue, Aug 14, 2012 at 12:33 PM, Armet, Lee <Lee.Armet(a)td.com> wrote:
  It turns out I am just impatient! I waited at least
ten minutes and
 nothing. However to answer your question:
 Vol.py -f /cases/memdump.mem imageinfo > 1.imaginfo
 I do it this way so I know what modules I've run and in which order.
 Thanks, Michael.
 Regards,
 Lee Armet | Senior Investigator, Forensic Technology Services| Global
 Security & Investigations | TD Bank Group
 T: (416) 982-6855 | M: (647) 242-0002
  *From*: Michael Hale Ligh [mailto:michael.hale@gmail.com]
 *Sent*: Tuesday, August 14, 2012 12:24 PM
 *To*: Armet, Lee
 *Cc*: Vol-users(a)volatilityfoundation.org <Vol-users(a)volatilityfoundation.org>
 *Subject*: Re: [Vol-users] Problem with 2.2_alpha
 Armet,
 What was your full command line used to produce the hang? If you'd like to
 try an older version of volatility, that would be a good idea as well - the
 2.1 and 2.0 releases are available here:
 
http://code.google.com/p/volatility/downloads/list.
 Thanks,
 MHL
 On Tue, Aug 14, 2012 at 11:22 AM, Armet, Lee <Lee.Armet(a)td.com> wrote:
  I imaged a live Win7 32bit system 3gb just now
with both ftkimager and
 winen and when I try to analyse the ram vol just hangs and hangs.
 The memory acquisition seemed to complete without error.
 Should I use an older version of vol?
 Regards,
 Lee Armet | Senior Investigator, Forensic Technology Services| Global
 Security & Investigations | TD Bank Group
 T: (416) 982-6855 | M: (647) 242-0002
 NOTICE: Confidential message which may be privileged. Unauthorized
 use/disclosure prohibited. If received in error, please go to
 
www.td.com/legal for instructions.
 AVIS : Message confidentiel dont le contenu peut être privilégié.
 Utilisation/divulgation interdites sans permission. Si reçu par erreur,
 prière d'aller au 
www.td.com/francais/avis_juridique pour des
 instructions.
 _______________________________________________
 Vol-users mailing list
 Vol-users(a)volatilityfoundation.org
 
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users