11:02 p.m.
Hi,
Anybody know where we can get the sample image mentioned
xp-laptop-2005-07-04-1430.img in README.txt?
I got http://www.cfreds.nist.gov/mem/memory-images.rar, but inside I
found only an Win2003 image, and it doesnt work with 1.3-beta.
If it is not there anymore, can anybody upload the XP image somewhere
for us to try?
Thanks,
J
11:48 p.m.
Hi,
You might want to verify that you downloaded complete image. The SHA1
and MD5 sums are:
MD5:
82c64f3292b7794d45cbffce6c5e51a2 memory-images.rar
SHA1:
70c68127faef865a45a0fcd4b5b360482f833b7f memory-images.rar
I just re-downloaded it from the NIST site and confirmed that it
contains:
boomer-win2003-2006-03-17.img
boomer-win2k-2006-02-27-0824.img
vista-beta2.img
xp-laptop-2005-06-25.img
xp-laptop-2005-07-04-1430.img
Cheers,
Brendan
On Oct 2, 2008, at 11:02 PM, Jun Koi wrote:
10:58 p.m.
On Fri, Oct 3, 2008 at 1:50 PM, Jun Koi <junkoi2004(a)gmail.com> wrote:
I can get these files. But what are their formats?
If I am not wrong, currently on crashdump & hilber files are
supported. I checked these 2 files, and none of them are crashdump or
hilber (I checked the first few bytes of them)
Many thanks,
J
11:12 p.m.
These are in DD format. They are direct dumps of physical memory, and
have no header. Physical address x in memory corresponds to file
address x in the file. This is the format that Volatility has
actually supported the longest -- crash and hiber are new :)
Are you having trouble getting Volatility to run on the sample images?
Cheers,
Brendan
On Oct 5, 2008, at 10:58 PM, Jun Koi wrote:
6025
days inactive
6028
days old
vol-users@lists.volatilityfoundation.org
5 comments
2 participants
participants (2)
-
Brendan Dolan-Gavitt -
Jun Koi