c-aff4 icon indicating copy to clipboard operation
c-aff4 copied to clipboard
verified publisher icon Velocidex

snappy compression not supported in linux 3.3rc1

Open mgreen27 opened this issue 6 years ago • 0 comments

Im extracting physical memory collected with snappy compression and it looks as though this compression method isnt implemented in the linux binary.

Collection: winpmem_v3.3.rc3.exe -dd -o yolo.aff -t -c snappy

Extraction linux (3.3rc1: ./linpmem-v3.3.rc1 -e */PhysicalMemory -D output/ yolo.aff 2019-12-19 06:22:58 E Compression method https://tools.ietf.org/html/rfc1951 is not supported by this implementation. NOT_IMPLEMENTED: at volume_group.cc: 29 NOT_IMPLEMENTED: at aff4_map.cc: 102 NOT_IMPLEMENTED: at volume_group.cc: 65 NOT_IMPLEMENTED: at aff4_imager_utils.cc: 28 2019-12-19 06:22:58 E Error: NOT_IMPLEMENTED

I am able to extract with the windows rc3: winpmem_v3.3.rc3.exe -dd -e */PhysicalMemory -D output yolo.aff4

mgreen27 avatar Dec 19 '19 06:12 mgreen27