You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I was trying to obtain FVEK from my memory dump and I used a plugin named "bitlocker".
so I ran the program with this plugin
here is the result:
maxfuwin@maxfuwin-virtual-machine:~/Desktop/volatility$ sudo python2 vol.py -f aowtput.mem --profile Win10x64_19041 bitlocker
[sudo] password for maxfuwin:
Volatility Foundation Volatility Framework 2.6.1
Address Cipher FVEK TWEAK Key
No suitable address space mapping found
Tried to open image as:
MachOAddressSpace: mac: need base
LimeAddressSpace: lime: need base
WindowsHiberFileSpace32: No base Address Space
WindowsCrashDumpSpace64BitMap: No base Address Space
VMWareMetaAddressSpace: No base Address Space
WindowsCrashDumpSpace64: No base Address Space
HPAKAddressSpace: No base Address Space
VirtualBoxCoreDumpElf64: No base Address Space
QemuCoreDumpElf: No base Address Space
VMWareAddressSpace: No base Address Space
WindowsCrashDumpSpace32: No base Address Space
SkipDuplicatesAMD64PagedMemory: No base Address Space
WindowsAMD64PagedMemory: No base Address Space
LinuxAMD64PagedMemory: No base Address Space
AMD64PagedMemory: No base Address Space
IA32PagedMemoryPae: No base Address Space
IA32PagedMemory: No base Address Space
OSXPmemELF: No base Address Space
MachOAddressSpace: MachO Header signature invalid
LimeAddressSpace: Invalid Lime header signature
WindowsHiberFileSpace32: No xpress signature found
WindowsCrashDumpSpace64BitMap: Header signature invalid
VMWareMetaAddressSpace: VMware metadata file is not available
WindowsCrashDumpSpace64: Header signature invalid
HPAKAddressSpace: Invalid magic found
VirtualBoxCoreDumpElf64: ELF Header signature invalid
QemuCoreDumpElf: ELF Header signature invalid
VMWareAddressSpace: Invalid VMware signature: 0xd8b4c813
WindowsCrashDumpSpace32: Header signature invalid
SkipDuplicatesAMD64PagedMemory: Failed valid Address Space check
WindowsAMD64PagedMemory: Failed valid Address Space check
LinuxAMD64PagedMemory: Incompatible profile Win10x64_19041 selected
AMD64PagedMemory: Failed valid Address Space check
IA32PagedMemoryPae: Incompatible profile Win10x64_19041 selected
IA32PagedMemory: Incompatible profile Win10x64_19041 selected
OSXPmemELF: ELF Header signature invalid
FileAddressSpace: Must be first Address Space
ArmAddressSpace: Profile does not have valid Address Space check
The text was updated successfully, but these errors were encountered:
I was trying to obtain FVEK from my memory dump and I used a plugin named "bitlocker".
so I ran the program with this plugin
here is the result:
maxfuwin@maxfuwin-virtual-machine:~/Desktop/volatility$ sudo python2 vol.py -f aowtput.mem --profile Win10x64_19041 bitlocker
[sudo] password for maxfuwin:
Volatility Foundation Volatility Framework 2.6.1
Address Cipher FVEK TWEAK Key
No suitable address space mapping found
Tried to open image as:
MachOAddressSpace: mac: need base
LimeAddressSpace: lime: need base
WindowsHiberFileSpace32: No base Address Space
WindowsCrashDumpSpace64BitMap: No base Address Space
VMWareMetaAddressSpace: No base Address Space
WindowsCrashDumpSpace64: No base Address Space
HPAKAddressSpace: No base Address Space
VirtualBoxCoreDumpElf64: No base Address Space
QemuCoreDumpElf: No base Address Space
VMWareAddressSpace: No base Address Space
WindowsCrashDumpSpace32: No base Address Space
SkipDuplicatesAMD64PagedMemory: No base Address Space
WindowsAMD64PagedMemory: No base Address Space
LinuxAMD64PagedMemory: No base Address Space
AMD64PagedMemory: No base Address Space
IA32PagedMemoryPae: No base Address Space
IA32PagedMemory: No base Address Space
OSXPmemELF: No base Address Space
MachOAddressSpace: MachO Header signature invalid
LimeAddressSpace: Invalid Lime header signature
WindowsHiberFileSpace32: No xpress signature found
WindowsCrashDumpSpace64BitMap: Header signature invalid
VMWareMetaAddressSpace: VMware metadata file is not available
WindowsCrashDumpSpace64: Header signature invalid
HPAKAddressSpace: Invalid magic found
VirtualBoxCoreDumpElf64: ELF Header signature invalid
QemuCoreDumpElf: ELF Header signature invalid
VMWareAddressSpace: Invalid VMware signature: 0xd8b4c813
WindowsCrashDumpSpace32: Header signature invalid
SkipDuplicatesAMD64PagedMemory: Failed valid Address Space check
WindowsAMD64PagedMemory: Failed valid Address Space check
LinuxAMD64PagedMemory: Incompatible profile Win10x64_19041 selected
AMD64PagedMemory: Failed valid Address Space check
IA32PagedMemoryPae: Incompatible profile Win10x64_19041 selected
IA32PagedMemory: Incompatible profile Win10x64_19041 selected
OSXPmemELF: ELF Header signature invalid
FileAddressSpace: Must be first Address Space
ArmAddressSpace: Profile does not have valid Address Space check
The text was updated successfully, but these errors were encountered: