Hello,

I've ran winpmem (https://github.com/Velocidex/WinPmem/releases/tag/v4.0.rc1) to get the RAW file from the RAM memory.
Then I've used volatility2, to get the .DMP file of the lsass process, also tried volatility3 to dump the process memory.

invoke-powerextract -PathToDMP 'C:\740.dmp' -Debug $true DEBUG: Inputfile valid and identified in: C:\740.dmp DEBUG: Header of Dumpfile parsed. Dumpfile holds 2652553094 Streams.

I understand that in the demo you only have 16 streams, but, is there anything that I can do?

Tried on a Win10-22H2 and on a Win10-1909 but same result.

PS C:\temp\PowerExtract> Invoke-PowerExtract -PathToDMP C:\temp\lsass.DMP
New-Object : Cannot find type [â€TypeName System.IO.FileStream â€ArgumentList]: verify that the assembly containing
this type is loaded.
At C:\temp\PowerExtract\Invoke-PowerExtract.ps1:409 char:23

• ... ileStream = New-Object –TypeName System.IO.FileStream –ArgumentLi ...

•             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : InvalidType: (:) [New-Object], PSArgumentException
  • FullyQualifiedErrorId : TypeNotFound,Microsoft.PowerShell.Commands.NewObjectCommand

New-Object : Cannot find type [â€TypeName System.IO.BinaryReader â€ArgumentList]: verify that the assembly containing
this type is loaded.
At C:\temp\PowerExtract\Invoke-PowerExtract.ps1:410 char:23

• ... ileReader = New-Object –TypeName System.IO.BinaryReader –Argument ...

•             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : InvalidType: (:) [New-Object], PSArgumentException
  • FullyQualifiedErrorId : TypeNotFound,Microsoft.PowerShell.Commands.NewObjectCommand

The property 'Position' cannot be found on this object. Verify that the property exists and can be set.
At C:\temp\PowerExtract\Invoke-PowerExtract.ps1:412 char:9

•     $fileReader.BaseStream.Position=0
  

•     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : InvalidOperation: (:) [], RuntimeException
  • FullyQualifiedErrorId : PropertyNotFound

You cannot call a method on a null-valued expression.
At C:\temp\PowerExtract\Invoke-PowerExtract.ps1:413 char:9

•     $Signature = Convert-LitEdian -String ([System.BitConverter]: ...
  

•     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : InvalidOperation: (:) [], RuntimeException
  • FullyQualifiedErrorId : InvokeMethodOnNull

You cannot call a method on a null-valued expression.
At C:\temp\PowerExtract\Invoke-PowerExtract.ps1:415 char:9

•     $Version = Convert-LitEdian -String ([System.BitConverter]::T ...
  

•     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : InvalidOperation: (:) [], RuntimeException
  • FullyQualifiedErrorId : InvokeMethodOnNull

You cannot call a method on a null-valued expression.
At C:\temp\PowerExtract\Invoke-PowerExtract.ps1:417 char:9

•     $ImplementationVersion = Convert-LitEdian -String ([System.Bi ...
  

•     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : InvalidOperation: (:) [], RuntimeException
  • FullyQualifiedErrorId : InvokeMethodOnNull

After importing the .ps1 file and trying to execute without parameters the script throws errors.
Steps to reproduce:

1. Import .ps1
2. Execute without parameters

Invoke-PowerExtract