No suitable address space mapping found

[leandroflxsilva]

Hello, i have a problem with Volatility version 2.6. I'm using Windows 10 but the copy is Windows 7 32bits.
First command:

Second command:

[gleeda]

Could you try to use the other Win7SP1x86_23418 profile? If that doesn't work, could you run kdbgscan and see what comes back from that?

[leandroflxsilva]

I tried with the profile Win7SP1x86_23418

The result of the command kdbgscan is this:

[atcuno]

Can you try with --profile= instead of profile: ? I have never seen that form of command line argument and I am not sure if Volatility will support it.

Also, how was memory acquired?

[leandroflxsilva]

I tried with the command "--profile"

I acquired the memory with the FTK IMAGER.

[atcuno]

it would be --profile=Win7SP1x86_23418

note the = instead of :

[leandroflxsilva]

Wow, it worked.Thank you so much.

[atcuno]

Glad it worked!