diff --git a/volatility/framework/interfaces/automagic.py b/volatility/framework/interfaces/automagic.py index 194681b95..913cd043c 100644 --- a/volatility/framework/interfaces/automagic.py +++ b/volatility/framework/interfaces/automagic.py @@ -7,12 +7,15 @@ runs. Automagic objects attempt to automatically fill configuration values that a user has not filled. """ +import logging from abc import ABCMeta from typing import Any, List, Optional, Tuple, Union, Type from volatility.framework import interfaces, constants from volatility.framework.configuration import requirements +vollog = logging.getLogger(__name__) + class AutomagicInterface(interfaces.configuration.ConfigurableInterface, metaclass = ABCMeta): """Class that defines an automagic component that can help fulfill @@ -121,3 +124,8 @@ class StackerLayerInterface(metaclass = ABCMeta): layer_name: Name of the layer to stack on top of progress_callback: A callback function to indicate progress through a scan (if one is necessary) """ + + @classmethod + def stacker_slow_warning(cls): + vollog.warning( + "Reads to this layer are slow, it's recommended to use the layerwriter plugin once to produce a raw file") diff --git a/volatility/framework/layers/qemu.py b/volatility/framework/layers/qemu.py index a0847d7a2..2db247e01 100644 --- a/volatility/framework/layers/qemu.py +++ b/volatility/framework/layers/qemu.py @@ -227,4 +227,5 @@ class QemuStacker(interfaces.automagic.StackerLayerInterface): new_name = context.layers.free_layer_name("QemuSuspendLayer") context.config[interfaces.configuration.path_join(new_name, "base_layer")] = layer_name layer = QemuSuspendLayer(context, new_name, new_name) + cls.stacker_slow_warning() return layer