When running dmp2raw on a small (256MB) Windows crash dump, I get the following:<br><br>Traceback (most recent call last):                                                                                               | Time Remaining:  --:--:--<br>

  File &quot;volatility&quot;, line 219, in &lt;module&gt;<br>    main()<br>  File &quot;volatility&quot;, line 212, in main<br>    modules[argv[1]].execute(argv[1], argv[2:])<br>  File &quot;/root/memory_analysis/Volatility-1.3_Beta/vmodules.py&quot;, line 62, in execute<br>

    self.cmd_execute(module, args)<br>  File &quot;/root/memory_analysis/Volatility-1.3_Beta/vmodules.py&quot;, line 1746, in dmp2raw<br>    crash_to_dd(flat_address_space, types, opts.outfile)<br>  File &quot;/root/memory_analysis/Volatility-1.3_Beta/forensics/win32/crashdump.py&quot;, line 721, in crash_to_dd<br>

    for j in xrange(0, PageCount*0x1000, 0x1000):<br>OverflowError: long int too large to convert to int<br><br>dmpchk gives me the following info about this file:<br>DUMP_HEADER32:<br>MajorVersion            0x0000000f<br>

MinorVersion            0x00001772<br>KdSecondaryVersion      0x00000041<br>DirectoryTableBase      0x00122000<br>PfnDataBase             0x83200000<br>PsLoadedModuleList      0x81f5fc70<br>PsActiveProcessHead     0x81f55990<br>

MachineImageType        0x0000014c<br>NumberProcessors        0x00000002<br>BugCheckCode            0x0000007f<br>PaeEnabled              0x00000001<br>KdDebuggerDataBlock     0x81f3fc98<br>ProductType             0x00000001<br>

SuiteMask               0x00000110<br>WriterStatus            0x45474150<br><br>Physical Memory Description:<br>Number of runs: 2<br>FileOffset      Start Address   Length<br>00001000        00001000        0009a000<br>0009b000        00100000        dcf4d000<br>

dcfe7000        dd04c000<br><br>Any idea what the problem might be?<br>