Volatility not working with windows Livekd memory dump (.dmp)

volatilityfoundation / volatility

An advanced memory forensics framework

http://volatilityfoundation.org/

GNU General Public License v2.0

7.26k stars 1.28k forks source link

Volatility not working with windows Livekd memory dump (.dmp) #680

Open weabey opened 4 years ago

weabey commented 4 years ago

hello,

I used Windows LiveKd - Windows Sysinternals tool to extract the memory dump and tried volatility for analyse the same. However i could not figure out the imageinfo cannot proceed further. any-idea on how to solve this ?

Capture

frenchy35 commented 4 years ago

Hi,

I've the same issue, probably your dump come from a pro or eentreprise version of windows 10, memory seems to be crypted..

__ Philippe

atcuno commented 4 years ago

Can you please try with the latest version of Volatility by using a checkout from here (GitHub)? I see that you are running what appears to be the standalone executable, which is extremely old at this point.