Hiya Sebastian,

>From your output you can see that FirewireAddressSpace isn't listed as
an option that was tried.  That suggests that the firewire module
couldn't locate either libforensic1394 (the preferred option and the
only one that works with the juju stack) or libraw1394 (which only works
with the old firewire stack).

Since you've said you've had inception working (which relies on
libforensic1394), my guess is that the module got installed in
/usr/local/lib rather the /usr/lib, and it's possible that python can't
find it by default but that inception can.

You can check which modules volatility can see by running "python vol.py
--info", and I suspect the "AddressSpaces" list won't contain
FirewireAddressSpace as an entry.  If you run python, and then try the
command "import forensic1394", that will tell you whether python can
find it or not.  If you can an exception, then you'll have to figure out
how to install it so that python can see it by default.  If there's no
error, then we'll need to look further into what's causing the problem.

Also, I believe in the 2.3.1 release, it was a little temperamental
because the delay between enabling the bus, setting it to sbp2 mode, and
then trying to read data was too short.  If you get it detecting
firewire but having read problems, let me know and I'll walk you through
applying a patch that might help.

Mike  5:)