volatility icon indicating copy to clipboard operation
volatility copied to clipboard

"determining profile" not progressing & "you must specify something to do"

Open Eleiyas opened this issue 5 years ago • 0 comments

I'll try and keep it short. I am a massive novice with this sort of thing and I'm only doing this to try and find video-game files that were "unlocked" in memory when the game was open.

I have a 32GB RAM dump file, in the format of ".mem", that I am trying to extract any and all files from, namely unity assets, png files, jpeg files, .txt files, .txtasset files and .json files.

if I do volatility.exe imageinfo -f E:\RAMDUMP\20210112.mem it just sits on "determining profile" for hours and hours (likely due to it being a 32GB file).

if I try and bypass the profile thing, but defaulting to using Win10x64 profile, by using something like: volatility.exe -f E:\RAMDUMP\20210112.mem --profile=Win10x64 --plugins=dumpfiles volatility.exe --plugins=dumpfiles -f E:\RAMDUMP\20210112.mem --profile=Win10x64

it just tells me I haven't given it anything to do... I have read as much documentation as I can and I cannot see what I'm doing wrong here.

Eleiyas avatar Jan 18 '21 07:01 Eleiyas