-
Notifications
You must be signed in to change notification settings - Fork 380
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
windows.filescan
reports all files to be of size 216
#1040
Comments
So dumpfiles walks the pages that make up the contents of the stored file, whereas filescan just reads the That'll be the code in either Blech, looks like you go through the FileObject's SectionObjectPointer... Not fun. 5:S |
Describe the bug
windows.filescan
reports all files to be of size216
Context
Volatility Version: 2.5.0
Operating System: Ubuntu 22.04
Python Version: 3.10.12
Suspected Operating System: Windows 10
Command:
vol -f /mnt/d/Projects/dump.raw windows.filescan
To Reproduce
Run the plugin on any dump for windows 10
vol -f /mnt/d/Projects/dump.raw windows.filescan
Expected behavior
The correct Size is reported
Example output
Additional information
Dump files correctly saves and extracts the correct size of file object
The text was updated successfully, but these errors were encountered: