I was trying to obtain FVEK from my memory dump and I used a plugin named "bitlocker".
so I ran the program with this plugin
here is the result:
maxfuwin@maxfuwin-virtual-machine:~/Desktop/volatility$ sudo python2 vol.py -f aowtput.mem --profile Win10x64_19041 bitlocker
[sudo] password for maxfuwin:
Volatility Foundation Volatility Framework 2.6.1
Address Cipher FVEK TWEAK Key
No suitable address space mapping found
Tried to open image as:
MachOAddressSpace: mac: need base
LimeAddressSpace: lime: need base
WindowsHiberFileSpace32: No base Address Space
WindowsCrashDumpSpace64BitMap: No base Address Space
VMWareMetaAddressSpace: No base Address Space
WindowsCrashDumpSpace64: No base Address Space
HPAKAddressSpace: No base Address Space
VirtualBoxCoreDumpElf64: No base Address Space
QemuCoreDumpElf: No base Address Space
VMWareAddressSpace: No base Address Space
WindowsCrashDumpSpace32: No base Address Space
SkipDuplicatesAMD64PagedMemory: No base Address Space
WindowsAMD64PagedMemory: No base Address Space
LinuxAMD64PagedMemory: No base Address Space
AMD64PagedMemory: No base Address Space
IA32PagedMemoryPae: No base Address Space
IA32PagedMemory: No base Address Space
OSXPmemELF: No base Address Space
MachOAddressSpace: MachO Header signature invalid
LimeAddressSpace: Invalid Lime header signature
WindowsHiberFileSpace32: No xpress signature found
WindowsCrashDumpSpace64BitMap: Header signature invalid
VMWareMetaAddressSpace: VMware metadata file is not available
WindowsCrashDumpSpace64: Header signature invalid
HPAKAddressSpace: Invalid magic found
VirtualBoxCoreDumpElf64: ELF Header signature invalid
QemuCoreDumpElf: ELF Header signature invalid
VMWareAddressSpace: Invalid VMware signature: 0xd8b4c813
WindowsCrashDumpSpace32: Header signature invalid
SkipDuplicatesAMD64PagedMemory: Failed valid Address Space check
WindowsAMD64PagedMemory: Failed valid Address Space check
LinuxAMD64PagedMemory: Incompatible profile Win10x64_19041 selected
AMD64PagedMemory: Failed valid Address Space check
IA32PagedMemoryPae: Incompatible profile Win10x64_19041 selected
IA32PagedMemory: Incompatible profile Win10x64_19041 selected
OSXPmemELF: ELF Header signature invalid
FileAddressSpace: Must be first Address Space
ArmAddressSpace: Profile does not have valid Address Space check
I was trying to obtain FVEK from my memory dump and I used a plugin named "bitlocker". so I ran the program with this plugin here is the result:
maxfuwin@maxfuwin-virtual-machine:~/Desktop/volatility$ sudo python2 vol.py -f aowtput.mem --profile Win10x64_19041 bitlocker [sudo] password for maxfuwin: Volatility Foundation Volatility Framework 2.6.1
Address Cipher FVEK TWEAK Key
No suitable address space mapping found Tried to open image as: MachOAddressSpace: mac: need base LimeAddressSpace: lime: need base WindowsHiberFileSpace32: No base Address Space WindowsCrashDumpSpace64BitMap: No base Address Space VMWareMetaAddressSpace: No base Address Space WindowsCrashDumpSpace64: No base Address Space HPAKAddressSpace: No base Address Space VirtualBoxCoreDumpElf64: No base Address Space QemuCoreDumpElf: No base Address Space VMWareAddressSpace: No base Address Space WindowsCrashDumpSpace32: No base Address Space SkipDuplicatesAMD64PagedMemory: No base Address Space WindowsAMD64PagedMemory: No base Address Space LinuxAMD64PagedMemory: No base Address Space AMD64PagedMemory: No base Address Space IA32PagedMemoryPae: No base Address Space IA32PagedMemory: No base Address Space OSXPmemELF: No base Address Space MachOAddressSpace: MachO Header signature invalid LimeAddressSpace: Invalid Lime header signature WindowsHiberFileSpace32: No xpress signature found WindowsCrashDumpSpace64BitMap: Header signature invalid VMWareMetaAddressSpace: VMware metadata file is not available WindowsCrashDumpSpace64: Header signature invalid HPAKAddressSpace: Invalid magic found VirtualBoxCoreDumpElf64: ELF Header signature invalid QemuCoreDumpElf: ELF Header signature invalid VMWareAddressSpace: Invalid VMware signature: 0xd8b4c813 WindowsCrashDumpSpace32: Header signature invalid SkipDuplicatesAMD64PagedMemory: Failed valid Address Space check WindowsAMD64PagedMemory: Failed valid Address Space check LinuxAMD64PagedMemory: Incompatible profile Win10x64_19041 selected AMD64PagedMemory: Failed valid Address Space check IA32PagedMemoryPae: Incompatible profile Win10x64_19041 selected IA32PagedMemory: Incompatible profile Win10x64_19041 selected OSXPmemELF: ELF Header signature invalid FileAddressSpace: Must be first Address Space ArmAddressSpace: Profile does not have valid Address Space check