Volatility Foundation Volatility Framework 2.3.1 DEBUG : volatility.plugins.overlays.linux.linux: Ubuntu1304_3.8.0-30-generic: Found dwarf file System.map-3.8.0-30-generic with 613 symbols DEBUG : volatility.plugins.overlays.linux.linux: Ubuntu1304_3.8.0-30-generic: Found system file System.map-3.8.0-30-generic with 1 symbols DEBUG : volatility.obj : Applying modification from BashTypes DEBUG : volatility.obj : Applying modification from BasicObjectClasses DEBUG : volatility.obj : Applying modification from ELF64Modification DEBUG : volatility.obj : Applying modification from HPAKVTypes DEBUG : volatility.obj : Applying modification from LimeTypes DEBUG : volatility.obj : Applying modification from MachoTypes DEBUG : volatility.obj : Applying modification from MbrObjectTypes DEBUG : volatility.obj : Applying modification from VMwareVTypesModification DEBUG : volatility.obj : Applying modification from VirtualBoxModification DEBUG : volatility.obj : Applying modification from LinuxIntelOverlay DEBUG : volatility.obj : Applying modification from LinuxKmemCacheOverlay DEBUG : volatility.plugins.overlays.linux.linux: Requested symbol cache_chain not found in module kernel DEBUG : volatility.obj : Applying modification from LinuxMountOverlay DEBUG : volatility.obj : Applying modification from LinuxObjectClasses DEBUG : volatility.obj : Applying modification from LinuxOverlay DEBUG : volatility.obj : Applying modification from Linux64ObjectClasses DEBUG : volatility.plugins.overlays.linux.linux: Ubuntu1304_3.8.0-30-generic: Found dwarf file System.map-3.8.0-30-generic with 613 symbols DEBUG : volatility.plugins.overlays.linux.linux: Ubuntu1304_3.8.0-30-generic: Found system file System.map-3.8.0-30-generic with 1 symbols DEBUG : volatility.obj : Applying modification from BashTypes DEBUG : volatility.obj : Applying modification from BasicObjectClasses DEBUG : volatility.obj : Applying modification from ELF64Modification DEBUG : volatility.obj : Applying modification from HPAKVTypes DEBUG : volatility.obj : Applying modification from LimeTypes DEBUG : volatility.obj : Applying modification from MachoTypes DEBUG : volatility.obj : Applying modification from MbrObjectTypes DEBUG : volatility.obj : Applying modification from VMwareVTypesModification DEBUG : volatility.obj : Applying modification from VirtualBoxModification DEBUG : volatility.obj : Applying modification from LinuxIntelOverlay DEBUG : volatility.obj : Applying modification from LinuxKmemCacheOverlay DEBUG : volatility.plugins.overlays.linux.linux: Requested symbol cache_chain not found in module kernel DEBUG : volatility.obj : Applying modification from LinuxMountOverlay DEBUG : volatility.obj : Applying modification from LinuxObjectClasses DEBUG : volatility.obj : Applying modification from LinuxOverlay DEBUG : volatility.obj : Applying modification from Linux64ObjectClasses DEBUG : volatility.utils : Voting round DEBUG : volatility.utils : Trying DEBUG1 : volatility.utils : Failed instantiating MachOAddressSpace: mac: need base DEBUG : volatility.utils : Trying DEBUG1 : volatility.utils : Failed instantiating LimeAddressSpace: lime: need base DEBUG : volatility.utils : Trying DEBUG1 : volatility.utils : Failed instantiating WindowsHiberFileSpace32: No base Address Space DEBUG : volatility.utils : Trying DEBUG1 : volatility.utils : Failed instantiating WindowsCrashDumpSpace64: No base Address Space DEBUG : volatility.utils : Trying DEBUG1 : volatility.utils : Failed instantiating HPAKAddressSpace: No base Address Space DEBUG : volatility.utils : Trying DEBUG1 : volatility.utils : Failed instantiating VirtualBoxCoreDumpElf64: No base Address Space DEBUG : volatility.utils : Trying DEBUG1 : volatility.utils : Failed instantiating VMWareSnapshotFile: No base Address Space DEBUG : volatility.utils : Trying DEBUG1 : volatility.utils : Failed instantiating WindowsCrashDumpSpace32: No base Address Space DEBUG : volatility.utils : Trying DEBUG1 : volatility.utils : Failed instantiating AMD64PagedMemory: No base Address Space DEBUG : volatility.utils : Trying DEBUG1 : volatility.utils : Failed instantiating IA32PagedMemoryPae: No base Address Space DEBUG : volatility.utils : Trying DEBUG1 : volatility.utils : Failed instantiating IA32PagedMemory: No base Address Space DEBUG : volatility.utils : Trying DEBUG : volatility.utils : Succeeded instantiating DEBUG : volatility.utils : Voting round DEBUG : volatility.utils : Trying DEBUG1 : volatility.utils : Failed instantiating MachOAddressSpace: MachO Header signature invalid DEBUG : volatility.utils : Trying DEBUG1 : volatility.utils : Failed instantiating LimeAddressSpace: Invalid Lime header signature DEBUG : volatility.utils : Trying DEBUG1 : volatility.utils : Failed instantiating WindowsHiberFileSpace32: PO_MEMORY_IMAGE is not available in profile DEBUG : volatility.utils : Trying DEBUG1 : volatility.utils : Failed instantiating WindowsCrashDumpSpace64: Header signature invalid DEBUG : volatility.utils : Trying DEBUG1 : volatility.utils : Failed instantiating HPAKAddressSpace: Invalid magic found DEBUG : volatility.utils : Trying DEBUG1 : volatility.utils : Failed instantiating VirtualBoxCoreDumpElf64: ELF64 Header signature invalid DEBUG : volatility.utils : Trying DEBUG1 : volatility.utils : Failed instantiating VMWareSnapshotFile: Invalid VMware signature: 0xf000ff53 DEBUG : volatility.utils : Trying DEBUG1 : volatility.utils : Failed instantiating WindowsCrashDumpSpace32: Header signature invalid DEBUG : volatility.utils : Trying DEBUG : volatility.utils : Succeeded instantiating DEBUG : volatility.utils : Voting round DEBUG : volatility.utils : Trying DEBUG1 : volatility.utils : Failed instantiating MachOAddressSpace: MachO Header signature invalid DEBUG : volatility.utils : Trying DEBUG1 : volatility.utils : Failed instantiating LimeAddressSpace: Invalid Lime header signature DEBUG : volatility.utils : Trying DEBUG1 : volatility.utils : Failed instantiating WindowsHiberFileSpace32: PO_MEMORY_IMAGE is not available in profile DEBUG : volatility.utils : Trying DEBUG1 : volatility.utils : Failed instantiating WindowsCrashDumpSpace64: Header signature invalid DEBUG : volatility.utils : Trying DEBUG1 : volatility.obj : None object instantiated: Invalid Address 0x00000000, instantiating HPAK_HEADER DEBUG1 : volatility.utils : Failed instantiating HPAKAddressSpace: Invalid magic found DEBUG : volatility.utils : Trying DEBUG1 : volatility.utils : Failed instantiating VirtualBoxCoreDumpElf64: ELF64 Header signature invalid DEBUG : volatility.utils : Trying DEBUG1 : volatility.obj : None object instantiated: Invalid Address 0x00000000, instantiating _VMWARE_HEADER DEBUG1 : volatility.utils : Failed instantiating VMWareSnapshotFile: Invalid VMware signature: - DEBUG : volatility.utils : Trying DEBUG1 : volatility.utils : Failed instantiating WindowsCrashDumpSpace32: Header signature invalid DEBUG : volatility.utils : Trying DEBUG1 : volatility.utils : Failed instantiating AMD64PagedMemory: Can not stack over another paging address space DEBUG : volatility.utils : Trying DEBUG1 : volatility.utils : Failed instantiating IA32PagedMemoryPae: Incompatible profile LinuxUbuntu1304_3_8_0-30-genericx64 selected DEBUG : volatility.utils : Trying DEBUG1 : volatility.utils : Failed instantiating IA32PagedMemory: Incompatible profile LinuxUbuntu1304_3_8_0-30-genericx64 selected DEBUG : volatility.utils : Trying DEBUG1 : volatility.utils : Failed instantiating FileAddressSpace: Must be first Address Space DEBUG : volatility.utils : Trying DEBUG1 : volatility.utils : Failed instantiating ArmAddressSpace: Can not stack over another paging address space DEBUG : volatility.plugins.overlays.linux.linux: Requested symbol wall_to_monotonic not found in module kernel DEBUG : volatility.plugins.overlays.linux.linux: Requested symbol total_sleep_time not found in module kernel DEBUG1 : volatility.obj : None object instantiated: Pointer mm invalid DEBUG1 : volatility.obj : None object instantiated: Pointer mm invalid DEBUG : volatility.plugins.overlays.linux.linux: Requested symbol wall_to_monotonic not found in module kernel DEBUG : volatility.plugins.overlays.linux.linux: Requested symbol total_sleep_time not found in module kernel DEBUG1 : volatility.obj : None object instantiated: Pointer mm invalid DEBUG1 : volatility.obj : None object instantiated: Pointer mm invalid DEBUG : volatility.plugins.overlays.linux.linux: Requested symbol wall_to_monotonic not found in module kernel DEBUG : volatility.plugins.overlays.linux.linux: Requested symbol total_sleep_time not found in module kernel DEBUG1 : volatility.obj : None object instantiated: Pointer mm invalid DEBUG1 : volatility.obj : None object instantiated: Pointer mm invalid DEBUG : volatility.plugins.overlays.linux.linux: Requested symbol wall_to_monotonic not found in module kernel DEBUG : volatility.plugins.overlays.linux.linux: Requested symbol total_sleep_time not found in module kernel DEBUG1 : volatility.obj : None object instantiated: Pointer mm invalid DEBUG1 : volatility.obj : None object instantiated: Pointer mm invalid DEBUG : volatility.plugins.overlays.linux.linux: Requested symbol wall_to_monotonic not found in module kernel DEBUG : volatility.plugins.overlays.linux.linux: Requested symbol total_sleep_time not found in module kernel