I'm trying to use a plugin (not built-in) with volatility 2.4 but am having trouble with the syntax. I know that at least for the native python (vol.py) the plugins option must be specified directly after vol.py. I've tried specifying the plugins directory as an absolute path and a relative path.
volatility.exe --plugins=C:\volatility\plugins -f=memImage.mem --profile=Win7SP1x86 usnparser > usnparser.txt
Inside the plugins directory is:
The error message I get is:
ERROR : volatility.debug : You must specify something to do (try -h)
This is the error I get anytime I specify a plugin that doesn't exist. I've tried this with a few plugins that don't come with volatility. I get the same results every time. Will probably move to using the default python version, but I'm curious why I can't get this working with the Windows executable.