Traceback (most recent call last):
  File "volatility", line 219, in 
    main()
  File "volatility", line 201, in main
    MemoryRegistry.Init()
  File "/Users/jessek/Volatility-1.3_Beta/forensics/registry.py", line 269, in Init
    OBJECT_CLASSES = VolatilityObjectRegistry(object2.Object)
  File "/Users/jessek/Volatility-1.3_Beta/forensics/registry.py", line 244, in __init__
    raise Exception("Object %s has already been defined by %s" % (obj,self.objects[obj]))
Exception: Object _EPROCESS has already been defined by class 'example3._eprocess'="'example3._EPROCESS'">

using System.Runtime.InteropServices;	// Needed for DllImport

public class ssdeepWrapper
{
     // fuzzy.dll should be somewhere in the path or specify exactly
     // where to find it.
     [DllImport("fuzzy.dll")]
         public static extern int fuzzy_hash_filename(string fname, 
StringBuilder result);
     [DllImport("fuzzy.dll")]
         public static extern int fuzzy_compare(string sig1, string sig2);
}

This paper documents the BitLocker Drive Encryption system included with some versions of Microsoft's Windows Vista. In particular it describes the key management system, the algorithms and modes used, and the metadata format. Particular attention is given to methods forensic examiners can use to access protected data. There are some unanswered questions about how the cryptosystem operates, including an undocumented key management decision. This decision could allow, in a particular usage scenario, unauthorized access to a protected volume.