Hello Thomas, Can you please send the following to help us diagnose the issue: 1) Your version of osxpmem 2) Input/output of osxpmem against your 10.9 system 3) If osxpmem produced a memory dump, but Volatility could not analyze it, could you please then send your Volatility command line input/output as well We have had several reports of people using osxpmem to acquire memory of 10.9.x followed by successful analysis of it with Volatility. It is also currently the only tool that can pull 10.9.x at all so we want to make sure Volatility stays compatible with it. Thanks, Andrew (@attrc) On 4/6/2014 6:14 AM, Thomas wrote: