Re: [Vol-users] MFT Parser 64 Bit
17 Apr
2014
17 Apr
'14
10:15 a.m.
Hi Markus,
So, I haven't seen this behavior before, but I was wondering: do you
have the this plugin: volatility/plugins/registry/shellbags.py ? That's
where NullString is actually defined. If you are missing that plugin,
then you are missing that definition. Also, which version of Volatility
are you running?
All the best,
-Jamie
On 4/9/2014 3:56 PM, markus neis wrote:
Hi,
is anybody else also running into issues when using mftparser on Win7 64
Bit?
I get the following:
WARNING : volatility.obj : Cant find object NullString in profile
<volatility.plugins.overlays.windows.win7.Win7SP1x64 object at 0xb4fc44c>?
Which results in entries like:
(FN)
0x184000|None\None\None\None\None\None\None|153380|---a-----------|0|0|480|1336379877|1336379877|1336379877|1336379877
Thanks,
Markus
_______________________________________________
Vol-users mailing list
Vol-users(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
Attachments:
- 0x27A4AC92.asc (application/pgp-keys — 2.2 KB)