From 310b6508db305b46288e5d0f530ca169ce020726 Mon Sep 17 00:00:00 2001 From: Eve Date: Wed, 11 Oct 2023 09:09:15 +0100 Subject: [PATCH 1/2] vmware: Add warning when no metadata file is found for a vmem file. --- volatility3/framework/layers/vmware.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/volatility3/framework/layers/vmware.py b/volatility3/framework/layers/vmware.py index 0bc1a350b..5467c70c0 100644 --- a/volatility3/framework/layers/vmware.py +++ b/volatility3/framework/layers/vmware.py @@ -232,6 +232,9 @@ class VmwareStacker(interfaces.automagic.StackerLayerInterface): ) if not vmss_success and not vmsn_success: + vollog.warning( + f"No metadata file alongside VMEM file! A VMSS or VMSN file is required to correctly process a VMEM file. These should be placed in the same directory with the same file name, e.g. sample.vmem and sample.vmsn.", + ) return None new_layer_name = context.layers.free_layer_name("VmwareLayer") context.config[ From e45380f4f579e3c54f1475312efc2aff47341b2a Mon Sep 17 00:00:00 2001 From: Eve Date: Fri, 13 Oct 2023 09:29:46 +0100 Subject: [PATCH 2/2] Update vmware layer metadata file warning to be less doom and gloom. --- volatility3/framework/layers/vmware.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/layers/vmware.py b/volatility3/framework/layers/vmware.py index 5467c70c0..622ff0250 100644 --- a/volatility3/framework/layers/vmware.py +++ b/volatility3/framework/layers/vmware.py @@ -4,6 +4,7 @@ import contextlib import logging import struct +import os from typing import Any, Dict, List, Optional from volatility3.framework import constants, exceptions, interfaces @@ -232,8 +233,10 @@ class VmwareStacker(interfaces.automagic.StackerLayerInterface): ) if not vmss_success and not vmsn_success: + vmem_file_basename = os.path.basename(location) + example_vmss_file_basename = os.path.basename(vmss) vollog.warning( - f"No metadata file alongside VMEM file! A VMSS or VMSN file is required to correctly process a VMEM file. These should be placed in the same directory with the same file name, e.g. sample.vmem and sample.vmsn.", + f"No metadata file found alongside VMEM file. A VMSS or VMSN file may be required to correctly process a VMEM file. These should be placed in the same directory with the same file name, e.g. {vmem_file_basename} and {example_vmss_file_basename}.", ) return None new_layer_name = context.layers.free_layer_name("VmwareLayer")