{"action":"created","issue":{"url":"https://api.github.com/repos/google/rekall/issues/51","labels_url":"https://api.github.com/repos/google/rekall/issues/51/labels{/name}","comments_url":"https://api.github.com/repos/google/rekall/issues/51/comments","events_url":"https://api.github.com/repos/google/rekall/issues/51/events","html_url":"https://github.com/google/rekall/issues/51","id":62348907,"number":51,"title":"winpmem elf acquisition to remote destination & parsing with Rekall 1.2.1","user":{"login":"alitorres","id":11518363,"avatar_url":"https://avatars.githubusercontent.com/u/11518363?v=3","gravatar_id":"","url":"https://api.github.com/users/alitorres","html_url":"https://github.com/alitorres","followers_url":"https://api.github.com/users/alitorres/followers","following_url":"https://api.github.com/users/alitorres/following{/other_user}","gists_url":"https://api.github.com/users/alitorres/gists{/gist_id}","starred_url":"https://api.github.com/users/alitorres/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alitorres/subscriptions","organizations_url":"https://api.github.com/users/alitorres/orgs","repos_url":"https://api.github.com/users/alitorres/repos","events_url":"https://api.github.com/users/alitorres/events{/privacy}","received_events_url":"https://api.github.com/users/alitorres/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-03-17T09:48:10Z","updated_at":"2015-03-17T10:51:43Z","closed_at":null,"body":"Hi, I have noticed that when I create an elf memory dump of my Windows 8.1 system and pass it over the network to my forensic workstation, it is only parsable with 1.2.0, not 1.2.1.  I am including the page file acquisition.  In addition, if I dump the elf output locally to the target system, I can copy it over to my workstation manually and parse it with 1.2.1.  Could this be an artifact of the image output over the wire or do you think it is my VM setup (VMWare Fusion - so all bets are off, I know).\r\n\r\nThoughts?  "},"comment":{"url":"https://api.github.com/repos/google/rekall/issues/comments/82268805","html_url":"https://github.com/google/rekall/issues/51#issuecomment-82268805","issue_url":"https://api.github.com/repos/google/rekall/issues/51","id":82268805,"user":{"login":"scudette","id":3856546,"avatar_url":"https://avatars.githubusercontent.com/u/3856546?v=3","gravatar_id":"","url":"https://api.github.com/users/scudette","html_url":"https://github.com/scudette","followers_url":"https://api.github.com/users/scudette/followers","following_url":"https://api.github.com/users/scudette/following{/other_user}","gists_url":"https://api.github.com/users/scudette/gists{/gist_id}","starred_url":"https://api.github.com/users/scudette/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/scudette/subscriptions","organizations_url":"https://api.github.com/users/scudette/orgs","repos_url":"https://api.github.com/users/scudette/repos","events_url":"https://api.github.com/users/scudette/events{/privacy}","received_events_url":"https://api.github.com/users/scudette/received_events","type":"User","site_admin":false},"created_at":"2015-03-17T10:51:43Z","updated_at":"2015-03-17T10:51:43Z","body":"Hi alitorres,\n  It sounds like there is a problem in the streaming of the image over the\nnetwork - how are you doing this? with netcat? Make sure that at the end of\nthe image there is a small yaml section which describes where the pagefile\nis in the elf image.  Maybe the network transfer is losing that last part.\n\nCan you please paste the output with -v for the 1.2.1 trying and failing to\nload the network tranferred image? maybe there are some clues there about\nwhat went wrong.\n\nAs a heads up, next week we will launch winpmem 2.0 alpha. But it probably\nwont have the ability to stream to the network just yet (but its coming).\nThe new image format we use by default is the AFF4 format (www.aff4.org)\nwhich allows us to naturally embed multiple streams in the image file (like\nmemory and pagefile and collected drivers, kernel etc).  The new alpha is\nnot yet a full replacement but we hope to make it feature complete very\nsoon.\n\nThanks\nMichael.\n\n\n\n\n\nOn 17 March 2015 at 10:48, alitorres <notifications@github.com> wrote:\n\n> Hi, I have noticed that when I create an elf memory dump of my Windows 8.1\n> system and pass it over the network to my forensic workstation, it is only\n> parsable with 1.2.0, not 1.2.1. I am including the page file acquisition.\n> In addition, if I dump the elf output locally to the target system, I can\n> copy it over to my workstation manually and parse it with 1.2.1. Could this\n> be an artifact of the image output over the wire or do you think it is my\n> VM setup (VMWare Fusion - so all bets are off, I know).\n>\n> Thoughts?\n>\n> —\n> Reply to this email directly or view it on GitHub\n> <https://github.com/google/rekall/issues/51>.\n>\n"}}