ECToo / volatility

Automatically exported from code.google.com/p/volatility
GNU General Public License v2.0
0 stars 0 forks source link

Timeliner Plugin UnicodeEncodeError on R 3513 #451

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago
What steps will reproduce the problem?
1. Run timeliner against memory dump taken with FTK Imager Lite 3.1.1
2. I cannot obtain another Image to take another dump to check the image 

What is the expected output? What do you see instead?
root@bt:/volatility# python vol.py -f memory.mem --profile=Win7SP1x86 timeliner 
--output=body > time.txt
Volatile Systems Volatility Framework 2.3_beta
Traceback (most recent call last):
  File "vol.py", line 186, in <module>
    main()
  File "vol.py", line 177, in main
    command.execute()
  File "/volatility/volatility/commands.py", line 111, in execute
    func(outfd, data)
  File "/volatility/volatility/plugins/timeliner.py", line 92, in render_body
    for line in data:
  File "/volatility/volatility/plugins/timeliner.py", line 371, in calculate
    base)
UnicodeEncodeError: 'ascii' codec can't encode characters in position 0-10: 
ordinal not in range(128)

What version of the product are you using? On what operating system?
Latest Trunk revision 
BT5R3 for volatility 
- timeliner works fine on other images 

Please provide any additional information below.
Windows 7 SP1 x86 system with 2GB of RAM taken with FTK Imager lite 3.1.1 onto 
an external USB 3.0 flash drive 

Original issue reported on code.google.com by wyattroe...@gmail.com on 7 Oct 2013 at 8:24

GoogleCodeExporter commented 9 years ago

Original comment by michael.hale@gmail.com on 7 Oct 2013 at 11:49

GoogleCodeExporter commented 9 years ago
Thanks for reporting Wyatt!  It should now be fixed in r3538

Original comment by jamie.l...@gmail.com on 25 Oct 2013 at 7:37