RE: [Vol-users] Unexpected results

Well shoot...yea psscan got me nothing either. So to prevent this in the future, what app are people using on 64 bit Windows and 8 gigs of ram? Also, Michael can I contact you off list for a non-volatility mailing list admin type question? Thank you. James -----Original Message----- From: Michael Ligh [mailto:michael.ligh@mnin.org] Sent: Tuesday, April 22, 2014 12:37 PM To: Lay, James Cc: vol-users(a)volatilityfoundation.org Subject: Re: [Vol-users] Unexpected results This happens quite often with x64 systems, large memory, and DumpIt. I'm sad to say the image was probably corrupted during acquisition, but you can test by acquiring with another tool or by loading your current memory dump in another analysis framework like Redline to see if it can recognize anything. Also, you can probably use psscan to get a partial list of processes by scanning. My guess is that some page(s) that are required for traversing the linked list of processes were not acquired properly. Hope this helps, -------------------------------------------------- Michael Ligh (@iMHLv2) GPG: http://mnin.org/gpg.pubkey.txt Blog: http://volatility-labs.blogspot.com On Apr 22, 2014, at 11:14 AM, Lay, James <james.lay(a)wincofoods.com> wrote: Win7SP0x64, Win2008R2SP1x64 (/home/bleh/bleh-20140421-203458.raw) Sess Wow64 Start Exit ------ ------ ------------------------------ ------------------------------ ------ 1 3302-11-11 21:17:40 UTC+0000 missing? My process: