I am trying to use printkey against a Windows XP image and keep getting an error when I use printkey.  I have also provided the commands I used for hivescan and hivelist which work great but printkey does not.  Does anyone have any suggestions as to why.  I initially thought it was because it was SP3 so I ran the same plugins against the xp-laptop-2005-06-25.img that was suggested to use in Brendan&#39;s guide but I get the same results.  Anyone have any thoughts as to why???<br>
<br><br>Mark Morgan<br>702-942-2556<br><br>


	<meta http-equiv="CONTENT-TYPE" content="text/html; charset=utf-8">
	<title></title>
	<meta name="GENERATOR" content="OpenOffice.org 3.1  (Linux)">
	<style type="text/css">
	<!--
		@page { margin: 0.79in }
		P { margin-bottom: 0.08in }
	-->
	</style>

<p style="margin-bottom: 0in;">morgan@morgan-laptop:/digitalforensics/Volatility-1.3_Beta$
./volatility hivescan -f /home/morgan/Memory\
Images/PhysicalMemory.bin 
</p>
<p style="margin-bottom: 0in;"><br>
</p>
<p style="margin-bottom: 0in;">Offset          (hex)          
</p>
<p style="margin-bottom: 0in;">181006344       0xac9f008      
</p>
<p style="margin-bottom: 0in;">181033824       0xaca5b60      
</p>
<p style="margin-bottom: 0in;">189972488       0xb52c008      
</p>
<p style="margin-bottom: 0in;">202671368       0xc148508      
</p>
<p style="margin-bottom: 0in;">544586592       0x2075bb60     
</p>
<p style="margin-bottom: 0in;">642878304       0x26518b60     
</p>
<p style="margin-bottom: 0in;">643895304       0x26611008     
</p>
<p style="margin-bottom: 0in;">678736920       0x2874b418     
</p>
<p style="margin-bottom: 0in;">740933640       0x2c29c008     
</p>
<p style="margin-bottom: 0in;">742706016       0x2c44cb60     
</p>
<p style="margin-bottom: 0in;">789179232       0x2f09eb60     
</p>
<p style="margin-bottom: 0in;">798029088       0x2f90f520     
</p>
<p style="margin-bottom: 0in;">1107776776      0x42075508     
</p>
<p style="margin-bottom: 0in;">1874516240      0x6fbad910     
</p>
<p style="margin-bottom: 0in;"><br>
</p>
<p style="margin-bottom: 0in;">morgan@morgan-laptop:/digitalforensics/Volatility-1.3_Beta$
./volatility hivelist -f /home/morgan/Memory\
Images/PhysicalMemory.bin -o 0xac9f008
</p>
<p style="margin-bottom: 0in;">Address      Name
</p>
<p style="margin-bottom: 0in;"><font style="font-size: 9pt;" size="2">0xe6348910
  \Documents and Settings\144553\Local Settings\Application
Data\Microsoft\Windows\UsrClass.dat
</font></p>
<p style="margin-bottom: 0in;"><font style="font-size: 9pt;" size="2">0xebe6e508
  \Documents and Settings\144553\NTUSER.DAT
</font></p>
<p style="margin-bottom: 0in;"><font style="font-size: 9pt;" size="2">0xe8287508
  \WINDOWS\system32\config\systemprofile\Local Settings\Application
Data\Microsoft\Windows\UsrClass.dat
</font></p>
<p style="margin-bottom: 0in;"><font style="font-size: 9pt;" size="2">0xe1895520
  \Documents and Settings\LocalService\Local Settings\Application
Data\Microsoft\Windows\UsrClass.dat
</font></p>
<p style="margin-bottom: 0in;"><font style="font-size: 9pt;" size="2">0xe1882b60
  \Documents and Settings\LocalService\NTUSER.DAT
</font></p>
<p style="margin-bottom: 0in;"><font style="font-size: 9pt;" size="2">0xe1396008
  \Documents and Settings\NetworkService\Local Settings\Application
Data\Microsoft\Windows\UsrClass.dat
</font></p>
<p style="margin-bottom: 0in;"><font style="font-size: 9pt;" size="2">0xe139ab60
  \Documents and Settings\NetworkService\NTUSER.DAT
</font></p>
<p style="margin-bottom: 0in;"><font style="font-size: 9pt;" size="2">0xe4f8eb60
  \WINDOWS\system32\config\SAM
</font></p>
<p style="margin-bottom: 0in;"><font style="font-size: 9pt;" size="2">0xe77b9b60
  \WINDOWS\system32\config\SECURITY
</font></p>
<p style="margin-bottom: 0in;"><font style="font-size: 9pt;" size="2">0xe77cd008
  \WINDOWS\system32\config\SOFTWARE
</font></p>
<p style="margin-bottom: 0in;"><font style="font-size: 9pt;" size="2">0xe77ca418
  \WINDOWS\system32\config\DEFAULT
</font></p>
<p style="margin-bottom: 0in;"><font style="font-size: 9pt;" size="2">0xe18b6008
  [no name]
</font></p>
<p style="margin-bottom: 0in;"><font style="font-size: 9pt;" size="2">0xe1035b60
  \WINDOWS\system32\config\SYSTEM
</font></p>
<p style="margin-bottom: 0in;"><font style="font-size: 9pt;" size="2">0xe102e008
  [no name]
</font></p>
<p style="margin-bottom: 0in;"><br>
</p>
<p style="margin-bottom: 0in;"><font style="font-size: 9pt;" size="2">morgan@morgan-laptop:/digitalforensics/Volatility-1.3_Beta$
./volatility printkey -f /home/morgan/Memory\
Images/PhysicalMemory.bin -o 0xe1035b60
</font></p>
<p style="margin-bottom: 0in;"><br>
</p>
<p style="margin-bottom: 0in;"><font style="font-size: 9pt;" size="2">Key
name: [9252] (Stable)
</font></p>
<p style="margin-bottom: 0in;"><font style="font-size: 9pt;" size="2">Last
updated: Wed Jul 29 02:08:26 2009
</font></p>
<p style="margin-bottom: 0in;"><font style="font-size: 9pt;" size="2">
</font></p>
<p style="margin-bottom: 0in;"><font style="font-size: 9pt;" size="2">Subkeys:
</font></p>
<p style="margin-bottom: 0in;"><font style="font-size: 9pt;" size="2">Traceback
(most recent call last):
</font></p>
<p style="margin-bottom: 0in;">  <font style="font-size: 9pt;" size="2">File
&quot;./volatility&quot;, line 219, in &lt;module&gt;
</font></p>
<p style="margin-bottom: 0in;">    <font style="font-size: 9pt;" size="2">main()
</font></p>
<p style="margin-bottom: 0in;">  <font style="font-size: 9pt;" size="2">File
&quot;./volatility&quot;, line 215, in main
</font></p>
<p style="margin-bottom: 0in;">    <font style="font-size: 9pt;" size="2">command.execute()
</font></p>
<p style="margin-bottom: 0in;">  <font style="font-size: 9pt;" size="2">File
&quot;memory_plugins/registry/printkey.py&quot;, line 97, in execute
</font></p>
<p style="margin-bottom: 0in;">    <font style="font-size: 9pt;" size="2">for
s in subkeys(key):
</font></p>
<p style="margin-bottom: 0in;">  <font style="font-size: 9pt;" size="2">File
&quot;/digitalforensics/Volatility-1.3_Beta/forensics/win32/rawreg.py&quot;,
line 144, in subkeys
</font></p>
<p style="margin-bottom: 0in;">    <font style="font-size: 9pt;" size="2">s.is_valid()
and s.Signature == NK_SIG]
</font></p>
<p style="margin-bottom: 0in;"><font style="font-size: 9pt;" size="2">AttributeError:
&#39;int&#39; object has no attribute &#39;is_valid&#39;
</font></p>
<p style="margin-bottom: 0in;"><br>
</p>
<p style="margin-bottom: 0in;"><font style="font-size: 9pt;" size="2">morgan@morgan-laptop:/digitalforensics/Volatility-1.3_Beta$
./volatility ident -f /home/morgan/Memory\ Images/PhysicalMemory.bin

</font></p>
<p style="margin-bottom: 0in;">              <font style="font-size: 9pt;" size="2">Image
Name: /home/morgan/Memory Images/PhysicalMemory.bin
</font></p>
<p style="margin-bottom: 0in;">              <font style="font-size: 9pt;" size="2">Image
Type: Service Pack 3
</font></p>
<p style="margin-bottom: 0in;">                 <font style="font-size: 9pt;" size="2">VM
Type: pae
</font></p>
<p style="margin-bottom: 0in;">                     <font style="font-size: 9pt;" size="2">DTB:
0x33e000
</font></p>
<p style="margin-bottom: 0in;">                <font style="font-size: 9pt;" size="2">Datetime:
Tue Aug 04 11:02:35 2009
</font></p>
<br>