Re: [Vol-users] Dump hives to diesk
12 Apr
2013
12 Apr
'13
6:12 p.m.
On 2013-04-12 16:09, James Lay wrote:
On 2013-04-12 15:59, Michael Cohen wrote:
Yea nevermind...reading helps 8-|
https://volatility.googlecode.com/svn/branches/scudette/docs/tutorial.html
Interactive mode...neat! Thank you!
James
you can try to install pytz :-)
for example on ubuntu the package is called python-tz:
apt-get install python-tz
on windows you need to get pip or easy install then
pip install pytz
Or you can try the windows binary from the downloads section because
it has no required dependencies.
Michael.
Heh..always so easy :) Thanks...it's flying now. Last thing I think
I need is plugins...here's what the TP responds with:
subcommands:
The following plugins can be selected.
Plugin
dis Disassemble the given address space.
dt Print a symbol.
dump Hexdump an object or memory location.
grep Search an address space for keywords.
guess_profile Guess the exact windows profile using
heuristics.
imagecopy Copies a physical address space out as a raw
DD image
info Print information about various subsystems.
load_as Load address spaces into the session if its
not
already loaded.
null This plugin does absolutely nothing.
peinfo Print information about a PE binary.
is there a different spot do snag the plugins, or am I barking up the
wrong tree? Thanks again for all your help on this.
James