From 019b0f9fdccac233d856333bb75b48ed7b9ff337 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Wed, 22 May 2019 13:30:12 -0500 Subject: [PATCH] Linux - add file extraction support for 4.18-4.20 --- volatility/plugins/linux/find_file.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/volatility/plugins/linux/find_file.py b/volatility/plugins/linux/find_file.py index 7591fcc4..0a69a62a 100644 --- a/volatility/plugins/linux/find_file.py +++ b/volatility/plugins/linux/find_file.py @@ -352,6 +352,8 @@ class linux_find_file(linux_common.AbstractLinuxCommand): def find_get_page(self, inode, offset): if hasattr(inode.i_mapping, "page_tree"): page = self.radix_tree_lookup_slot(inode.i_mapping.page_tree, offset) + elif hasattr(inode.i_mapping.i_pages, "rnode"): + page = self.radix_tree_lookup_slot(inode.i_mapping.i_pages, offset) else: page = self.walk_xarray(inode, offset)