I have been trying to use Volatility 2.6 to analyze memory dumps generated by DumpIt. I am experiencing an issue analyzing the memory dumps (all 4 GB in size) of two Windows 10 64 bit boxes (build numbers 18362.1 and 18362.476) and a Windows Server 2016 64 bit box (build number 14393). When running the below command to get the profile:
volatility -f memory_dump.dmp imageinfo
I get the below output:
INFO : volatility.debug : Determining profile based on KDBG search... WARNING : volatility.debug : Alignment of WindowsCrashDumpSpace64 is too small, plugins will be extremely slow WARNING : volatility.debug : Alignment of WindowsCrashDumpSpace64 is too small, plugins will be extremely slow
The above lines continue and it just hangs for about an hour before it shows the profile info. Even after loading the profile info, if I try commands such as 'pslist' and 'pstree' it loads right away but there are no processes returned in the output.
I also tried using FTK Imager to generate the memory dumps but when trying to analyze it in Volatility it hangs at the below line:
INFO : volatility.debug : Determining profile based on KDBG search...
I have tried using both the Volatility 2.6 binary in Windows 10 and the latest vol.py in Ubuntu 18.04 but I am experiencing the same issue.
However, I do not experience any issues with Windows 7 (32 bit) and Server 2008 (32 bit) memory dumps (both 4 GB in size) and Volatility loads the profile info within a few seconds. Also, when running the 'pslist' and 'pstree' commands, the output returned contains processes. Volatility also does not output any alignment errors (which were displayed for the Windows 10 and Server 2016 memory dumps).
Is there a way to address the problem experienced when analyzing Windows 10 and Server 2016 memory dumps?