commandme : python volatility connections -f memdump.txt
/work/Volatility-1.3_Beta/forensics/win32/crashdump.py:31: DeprecationWarning: the sha module is deprecated; use the hashlib module instead
import sha
Usage: connections [options] (see --help)
volatility: error: Unable to load image. Possible causes: invalid dtb, wrong image type, unsupported image type.
I suspect that FTK doesn't create a linear image.
I tried this on a Mac and WIndows.
If this is correct, does anyone know of an open source tool I can analyze this ftk memory dump with? I can't recreate another.
I tried wmft_0.2 but I think that this tool is in the early stages of development. I was only able to pul a lit of drivers with it.