Skip to content

Commit 15ad1db

Browse files
authored
Merge pull request #1016 from eve-mem/vmem_warnings
vmware: Add warning when no metadata file is found for a vmem file.
2 parents 93b2972 + e45380f commit 15ad1db

File tree

1 file changed

+6
-0
lines changed

1 file changed

+6
-0
lines changed

volatility3/framework/layers/vmware.py

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44
import contextlib
55
import logging
66
import struct
7+
import os
78
from typing import Any, Dict, List, Optional
89

910
from volatility3.framework import constants, exceptions, interfaces
@@ -232,6 +233,11 @@ def stack(
232233
)
233234

234235
if not vmss_success and not vmsn_success:
236+
vmem_file_basename = os.path.basename(location)
237+
example_vmss_file_basename = os.path.basename(vmss)
238+
vollog.warning(
239+
f"No metadata file found alongside VMEM file. A VMSS or VMSN file may be required to correctly process a VMEM file. These should be placed in the same directory with the same file name, e.g. {vmem_file_basename} and {example_vmss_file_basename}.",
240+
)
235241
return None
236242
new_layer_name = context.layers.free_layer_name("VmwareLayer")
237243
context.config[

0 commit comments

Comments
 (0)