evild3ad / MemProcFS-Analyzer

MemProcFS-Analyzer - Automated Forensic Analysis of Windows Memory Dumps for DFIR
https://lethal-forensics.com
GNU General Public License v3.0
548 stars 59 forks source link

Not executing #12

Closed archanchoudhury closed 2 years ago

archanchoudhury commented 2 years ago

Hi There, Thanks a lot for creating such an awesome tool. While running, it is throwing below error-

[Error] github.com is NOT reachable. Please check your network connection and try again.

My internet connection is working fine. Could you please let me know how to resolve this issue? image

evild3ad commented 2 years ago

Hi, it seems that github.com is not reachable. Are you using VPN or a proxy?

evild3ad commented 2 years ago

You can possibly uncomment line 471...the "Exit" command (and also line 479 for f001.backblazeb2.com).

archanchoudhury commented 2 years ago

No I am not using any VPN or proxy. I have removed the check from the script and it is running now. I believe, it is due to PingException at the github end. Probably you can give a test to google.com to see if the machine has internet connection or not.

image

image

evild3ad commented 2 years ago

Interesting...on my side it is always working.

github com

evild3ad commented 2 years ago

Which PowerShell version are you using?

evild3ad commented 2 years ago

Is this command working on your side?

if ((Test-NetConnection -ComputerName github.com -Port 443).TcpTestSucceeded) { Write-Output "True" }

archanchoudhury commented 2 years ago

I am using below:

image

Yes, above command works for me. Looks like we have to force 443

evild3ad commented 2 years ago

Will be fixed with the next version. Thanks for reporting!

archanchoudhury commented 2 years ago

Also one more thing.. I noticed the script is exited on a Dokan Check at the very beginning even before selecting the memory image. So, you might wanna tweak the logic to install the dependencies first and then put the option to select the image file. I have installed the Dokan explicitly on first run.

evild3ad commented 2 years ago

It is mentioned under Prerequisites, that you have to manually install Dokany first. Dokany needs most of the time a reboot of the system, that's the reason why it is not auto-installed and auto-updated. This simple check is only to make the script more robust.

I am already working on v0.7 and in parallel I will add more info to the Wiki.

A helpful introduction video is planned...but it will take some time I think. ;-)

Thanks again!