volatilityfoundation / volatilityfoundation/volatility3
Does Volatility support the Encase EX file format?
Open
Nobody has claimed this yet.
enhancement
question
- Dominant language
- Python
- Stars
- 4.4k
- Forks
- 705
- Avg merge
- 1d 10h
- Merged PRs (30d)
- 3
Description
Hello,
I'm sorry if this isn't the appropriate place - I couldn't find anywhere else that seemed appropriate. Two use questions
- I've placed my symbols table under symbols\linux\symbols.json - (generated by dwarf2json) - but I'm unable to find any documentation on the proper naming convention. Is it just .json? .json.xz? ntsomethingsomething.json?
- Are Encase EX files supported? I'm trying to support my internal DF team but getting errors of
- Warning volatility3.framework.plugins: automagic exception occured: +lzma.LZMAError: Input format not supported by decoder
- Unsatisfied Requirement plugins.PsList.primary: Memory layer for the kernel
- Unsatisfied Requirement plugins.PsList.vmlinux: Linux kernel symbols
Thank you
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the symbols\linux\symbols.json location and the symbol files generated by dwarf2json, then trace the PsList requirements shown in the errors. Determine whether Encase EX input is supported and clarify the expected symbol naming and compression formats; done means the support status and setup requirements are documented or the requested compatibility is defined.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- reverse-engineering, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100