Bug0058

Description

NTFS Bug in PyFlag

PyFlag fails the NTFS unit test on a single file for some reason. Sleuthkit does work on that file however.

when running the pf ntfs unit tests i get:
  Failed to read all data: wanted 656, got -1
File "/home/mic/pyflag/src/pyflag/Farm.py", line 275, in start_workers
task.run(row['arg1'], row['arg2'], row['arg3'])
File "src/plugins//Core.py", line 210, in run
Scanner.scanfile(ddfs, fd, factories)
File "/home/mic/pyflag/src/pyflag/Scanner.py", line 480, in scanfile
data = fd.read()
File "src/plugins/DiskForensics/FileSystems/Sleuthkit.py", line 122, in read
result= self.skfd.read(slack=self.slack, overread=self.overread)
None

the inode being scanned is Itest|K25-144-2 when i do just an icat ntfs_image.dd 25-144-2 it does work

Logged

2007-12-04

Logged By

Scudette

Assigned to

Status

Closed

Get back to the BugIndex

This ended up being a bug in sleuthkit itself which DaveC found and fixed (and sent a patch upstream).