Re: Problem Using Suspicious
When I run the script, I get the following error...

Traceback (most recent call last):
File "volatility", line 219, in
main()
File "volatility", line 215, in main
command.execute()
File "memory_plugins/suspicious.py", line 106, in execute
command_line = eprocess.CommandLine
File "C:\Documents and Settings\User\My Documents\Volatility-1.3_Beta\forensics\object2.py", line 96, in __getattribute__
return object.__getattribute__(self, attr)
File "memory_plugins/suspicious.py", line 155, in getCommandLine
if mypeb.ProcessParameters is None:
File "C:\Documents and Settings\User\My Documents\Volatility-1.3_Beta\forensics\object2.py", line 122, in __getattribute__
base_address = self.get_member(attr).v()
File "C:\Documents and Settings\User\My Documents\Volatility-1.3_Beta\forensics\object2.py", line 251, in v
return self.value()
File "C:\Documents and Settings\User\My Documents\Volatility-1.3_Beta\forensics\object2.py", line 255, in value
return self.type.v(self)
File "C:\Documents and Settings\User\My Documents\Volatility-1.3_Beta\forensics\object2.py", line 340, in v
return self.value(theObject)
File "C:\Documents and Settings\User\My Documents\Volatility-1.3_Beta\forensics\object2.py", line 344, in value
theObject.vm.read(theObject.offset, self.size))
File "C:\Python25\lib\struct.py", line 87, in unpack
return o.unpack(s)
struct.error: unpack requires a string argument of length 4

Is there another file that needs to be removed? Thanks.