search

volatilityfoundation / volatility

An advanced memory forensics framework
http://volatilityfoundation.org/
GNU General Public License v2.0
7.29k stars 1.28k forks source link

Help with LSA Dump #816

Open roza07102 opened 2 years ago

roza07102 commented 2 years ago

Unable to read LSA secrets from registry. Please I do I resolve this error?

cmueller-tp commented 2 years ago

which windows version are you using? (RTM build) Is everything else working in that image (like for example the shimcache plugin which also requires at least the registry stuff to properly work)?

In general those problems might be related to memory compression/swap as parts of the registry might get swapped out and you'd need a page fault handler resolving these reads (there is a volatility version that supports at least memory compression for some win10 version from fireeye)