Re: [Vol-users] VM image of memory- This is not a VMEM file
13 Feb
2012
13 Feb
'12
1:31 p.m.
Thanks for the responses, the VM is running 2003 server sp1. And I didnt capture it with
the normal image tools. I used EnCase Enterprise to connect to the system and grab memory,
however now that I think about it I'll try to use a capture tool and DD it. That may
solve it, EnCase doesn't do a DD image..unless I use a stand alone tool Winen that
comes packaged with EnCase.
I'll grab another dump and post back with my command line options after the dump.
Sent from my iPad
On Feb 12, 2012, at 6:36 PM, Michael Hale Ligh <michael.hale(a)gmail.com> wrote:
Lou,
On Fri, Feb 10, 2012 at 10:48 PM, Lou LaRocca <louislarocca(a)gmail.com> wrote:
When imaging memory on a live VM system to do
analysis for malware
Volatililty does not recognize it (see below). Is there anyone on this
mailing list that has the knowledge on how I can remedy this without
shutting the system down and grabbing the VMEM file?
You shouldn't have to shut the system down, if you're using VMware
(which it sounds like you are from the "VMEM"), then you can just
suspend it and the contents of memory will be flushed to the .vmem
file.
What's the OS version of the VMware system and what was the
command-line that you used (i.e. did you use the right --profile)?
MHL
> Is it possible to substitute a valid DTB from another image into the memdump
> of a live VM machine with a Hex editor? And if it can be done does anyone
> know the addresses of that space to take out and substitute? I hope that
> made sense......
>
> If you look at a normal image of memory in a hex editor you can clearly see
> the difference between that and a VM dump from a live system, there seems to
> be some extra padded stuff right up front.
>
>
>
>
>
>
>
> Volatile Systems Volatility Framework 2.0
> No suitable address space mapping found
> Tried to open image as:
> WindowsHiberFileSpace32: No base Address Space
> WindowsCrashDumpSpace32: No base Address Space
> JKIA32PagedMemory: No base Address Space
> JKIA32PagedMemoryPae: No base Address Space
> IA32PagedMemoryPae: Module disabled
> IA32PagedMemory: Module disabled
> WindowsHiberFileSpace32: No xpress signature fou
> WindowsCrashDumpSpace32: Header signature invali
> JKIA32PagedMemory: No valid DTB found
> JKIA32PagedMemoryPae: No valid DTB found
> IA32PagedMemoryPae: Module disabled
> IA32PagedMemory: Module disabled
> FileAddressSpace: Must be first Address Space
>
> Thanks
>
> Lou
>
>
>
> _______________________________________________
> Vol-users mailing list
> Vol-users(a)volatilityfoundation.org
> http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
>