AW: AW: Analyzing a Hiberfil.sys - Vol-users

3 Jul 2009

      Hello Brendan, hello all

thanks a lot for the carefree-all-around zip package. It works fine. The hiberfil.sys gets
decompressed now.

Thanks a lot to all other for their useful hints.

I have processed a "shortened" version of the original file without the
hiberfil-slack.

Now both programs (vol and WinHex) did decompress the file BUT:

The files have the same length but different md-5-sums because of 'some' binary
differences.

At the moment I don't know, which version is the 'right'.

Both mapped with X-Ways Forensics generated the following results:

WinHex-version: totally 1.465 objects, Volatility-version: 1.363 objects

I have compared the results and found, that some minor objects in the xwf-version are
duped but some objects are not found in the vol-version.

I have attached a list of the "missed" objects, quick and dirty, simply sorted
by name.

Maybe someone has a clue what may have caused this difference.

Currently I try to find a way to compare extracted objects by vol and XWF.

BR

Michael

@Andreas: Thanks for the offer to call you, will do that but need your
"Telefonnummer"...

-----Ursprüngliche Nachricht-----
Von: Dolan-gavitt, Brendan F [mailto:brendandg@gatech.edu] 
Gesendet: Donnerstag, 2. Juli 2009 20:20
An: AAron Walters
Cc: Michael Felber , Steufa Chemnitz, IT-Forensik
Betreff: Re: AW: Analyzing a Hiberfil.sys

I did indeed--you can get it here:

http://amnesia.gtisc.gatech.edu/~moyix/Volatility-SVN.zip

-Brendan

----- Original Message -----
From: "AAron Walters" &lt;awalters(a)4tphi.net&gt;
To: "Michael Felber , Steufa Chemnitz, IT-Forensik"
&lt;MichaelFelber(a)gmx.net&gt;
Cc: brendandg(a)gatech.edu
Sent: Thursday, July 2, 2009 11:13:55 AM GMT -05:00 US/Canada Eastern
Subject: Re: AW: Analyzing a Hiberfil.sys

Michael,

You will need to check out the entire repository. At one point, Brendan 
created a zip file.

Thanks,

AW

On Thu, 2 Jul 2009, Michael Felber , Steufa Chemnitz, IT-Forensik wrote:

...
  Hello Aaron,

 have downloaded most of the new  files but got volatility crashed with that.
 I assume I have to download ALL the new released files manually an copy them
 to their destination? Or is there a new complete package available?

 Cu

 Michael

 -----Ursprüngliche Nachricht-----
 Von: AAron Walters [mailto:awalters@4tphi.net]
 Gesendet: Donnerstag, 2. Juli 2009 16:22
 An: Michael Felber , Steufa Chemnitz, IT-Forensik
 Cc: brendandg(a)gatech.edu
 Betreff: Re: Analyzing a Hiberfil.sys

 Michael,

 Thanks for the email.  I'm glad you have found Volatility useful.  You may
 want to check out the latest version from the svn repository which
 includes a number of bug fixes.  Let me know if it generates the same
 errors.

 http://code.google.com/p/volatility/source/checkout

 Thanks,

 AW

 On Thu, 2 Jul 2009, Michael Felber , Steufa Chemnitz, IT-Forensik wrote:

  Hello,

 I am new to volatility but I am very impressed by the capabilities of that
 tool collection. I have already used it in a couple of cases and found
 interesting clues for further investigation more than one time. Thanks a
 lot, great tool.

 I used v 1.3 Beta with Python 2.6.2.  to analyze a hiberfil.sys. The try  to
  decompress it produced the following error
message:

 C:\Micha\Forensics\Volatility>python volatility hibinfo -f
 "F:\X-Ways-Images\##bad guy##\RAM-Analyse\NB Asus, Partition
 2\hiberfil-NB-ASUS.sys" –d "hiberfil-NB-ASUS-vol.sys"

 C:\Micha\Forensics\Volatility\forensics\win32\crashdump.py:31:
 DeprecationWarning: the sha module is deprecated; use the hashlib module
 instead

  import sha

 Signature:

 SystemTime: Thu Jan 01 00:00:00 1970

 Control registers flags

 CR0: 000212dd

 CR0[PAGING]: 0

 CR3: 0001d69f

 CR4: 00020160

 CR4[PSE]: 0

 CR4[PAE]: 1

 Traceback (most recent call last):

  File "volatility", line 219, in <module>

    main()

  File "volatility", line 212, in main

    modules[argv[1]].execute(argv[1], argv[2:])

  File "C:\Micha\Forensics\Volatility\vmodules.py", line 62, in execute

    self.cmd_execute(module, args)

  File "C:\Micha\Forensics\Volatility\vmodules.py", line 1677, in hibinfo

    (major,minor,build) =  hiberAS.get_version()

  File "C:\Micha\Forensics\Volatility\forensics\win32\hiber_addrspace.py",
 line 452, in get_version

    addr_space = IA32PagedMemoryPae(self,self.CR3)

 NameError: global name 'IA32PagedMemoryPae' is not defined

 Options –q, -t pae|nopae did not help.

 What went wrong?

 Kindest regards

 Michael Felber

 Agent in charge

 Michael Felber, StA

 Finanzamt Chemnitz-Süd

 Steuerfahndung

 IT-Forensik

 Paul-Bertz-Str. 1

 D-09120 Chemnitz

 Germany

 Fon:      +49 371 279 446

 Fax.      +49 371 279 421

: 