What steps will reproduce the problem?
1. Run timeliner against memory dump taken with FTK Imager Lite 3.1.1
2. I cannot obtain another Image to take another dump to check the image
What is the expected output? What do you see instead?
root@bt:/volatility# python vol.py -f memory.mem --profile=Win7SP1x86 timeliner
--output=body > time.txt
Volatile Systems Volatility Framework 2.3_beta
Traceback (most recent call last):
File "vol.py", line 186, in <module>
main()
File "vol.py", line 177, in main
command.execute()
File "/volatility/volatility/commands.py", line 111, in execute
func(outfd, data)
File "/volatility/volatility/plugins/timeliner.py", line 92, in render_body
for line in data:
File "/volatility/volatility/plugins/timeliner.py", line 371, in calculate
base)
UnicodeEncodeError: 'ascii' codec can't encode characters in position 0-10:
ordinal not in range(128)
What version of the product are you using? On what operating system?
Latest Trunk revision
BT5R3 for volatility
- timeliner works fine on other images
Please provide any additional information below.
Windows 7 SP1 x86 system with 2GB of RAM taken with FTK Imager lite 3.1.1 onto
an external USB 3.0 flash drive
Original issue reported on code.google.com by wyattroe...@gmail.com on 7 Oct 2013 at 8:24
Original issue reported on code.google.com by
wyattroe...@gmail.com
on 7 Oct 2013 at 8:24