Lazza / RecuperaBit

A tool for forensic file system reconstruction.
GNU General Public License v3.0
517 stars 73 forks source link

Error: string argument without an encoding #80

Closed jaredvv86 closed 3 years ago

jaredvv86 commented 3 years ago

Was running the program on a 500GB drive hoping I could save. I got the following error. Every thing seemed to be going okay. Was kind of slow but that is probably my fault.

I used the windows Subsystem for Linux. Using regular Python 3.

Any ideas?

INFO:root:Finalizing MFT reconstruction of partition at offset 63
INFO:root:Adding extra attributes from $ATTRIBUTE_LIST
INFO:root:Adding ghost entries from $INDEX_ALLOCATION
DEBUG:root:Found MATCH in positions {428583} with weight 169329 (88.87774972574914%)
INFO:root:Finalizing MFT reconstruction of partition at offset 63
INFO:root:Adding extra attributes from $ATTRIBUTE_LIST
INFO:root:Adding ghost entries from $INDEX_ALLOCATION
WARNING:root:Cannot read sector(s). Filling with 0x00. Offset: 396329295 Size: 8 Bsize: 512
Traceback (most recent call last):
  File "main.py", line 374, in <module>
    main()
  File "main.py", line 357, in main
    parts.update(scanner.get_partitions())
  File "/mnt/c/Users/Jared2/Desktop/RecuperaBit-master/recuperabit/fs/ntfs.py", line 837, in get_partitions
    self.finalize_reconstruction(part)
  File "/mnt/c/Users/Jared2/Desktop/RecuperaBit-master/recuperabit/fs/ntfs.py", line 685, in finalize_reconstruction
    self.add_from_indx_allocation(parsed, part)
  File "/mnt/c/Users/Jared2/Desktop/RecuperaBit-master/recuperabit/fs/ntfs.py", line 615, in add_from_indx_allocation
    dump = sectors(img, position, INDX_size)
  File "/mnt/c/Users/Jared2/Desktop/RecuperaBit-master/recuperabit/utils.py", line 61, in sectors
    return bytearray(dump)
TypeError: string argument without an encoding
sauron3256 commented 3 years ago

I got the same error during a scan on a corrupted 320gb drive:

INFO:root:Parsing MFT entries INFO:root:Parsing INDX records INFO:root:Reading boot sectors DEBUG:root:Dropping bogus NTFS partition with MFT position 29114394 generated by MFT mirror of partition at offset 29109232 DEBUG:root:Dropping bogus NTFS partition with MFT position 465488658 generated by MFT mirror of partition at offset 465483496 DEBUG:root:Dropping bogus NTFS partition with MFT position 465823082 generated by MFT mirror of partition at offset 465817920 INFO:root:Finding partition geometry INFO:root:Finalizing MFT reconstruction of partition at offset 0 INFO:root:Adding extra attributes from $ATTRIBUTE_LIST Traceback (most recent call last): File "/home/lef/RecuperaBit-1.1.4/main.py", line 374, in main() File "/home/lef/RecuperaBit-1.1.4/main.py", line 357, in main parts.update(scanner.get_partitions()) File "/home/lef/RecuperaBit-1.1.4/recuperabit/fs/ntfs.py", line 837, in get_partitions self.finalize_reconstruction(part) File "/home/lef/RecuperaBit-1.1.4/recuperabit/fs/ntfs.py", line 673, in finalize_reconstruction self.add_from_attribute_list(parsed, part, node.offset) File "/home/lef/RecuperaBit-1.1.4/recuperabit/fs/ntfs.py", line 628, in add_from_attribute_list _integrate_attribute_list(parsed, part, image) File "/home/lef/RecuperaBit-1.1.4/recuperabit/fs/ntfs.py", line 248, in _integrate_attribute_list dump = sectors(image, real_pos, FILE_size) File "/home/lef/RecuperaBit-1.1.4/recuperabit/utils.py", line 61, in sectors return bytearray(dump) TypeError: string argument without an encoding

Tried adding an encoding arguement on the return value @utils.py and got this error:

Traceback (most recent call last): File "/home/lef/RecuperaBit-1.1.4/main.py", line 374, in main() File "/home/lef/RecuperaBit-1.1.4/main.py", line 345, in main interesting = utils.feed_all(image, scanners, indexes) File "/home/lef/RecuperaBit-1.1.4/recuperabit/utils.py", line 119, in feed_all sector = sectors(image, index, 1, fill=False) File "/home/lef/RecuperaBit-1.1.4/recuperabit/utils.py", line 61, in sectors return bytearray(dump, 'utf8') TypeError: encoding without string argument (got 'bytes' instead)

Lazza commented 3 years ago

Please try with the latest code and let me know if it works for you.

sauron3256 commented 3 years ago

After running the scan again, I gor the following error:

INFO:root:Parsing MFT entries Traceback (most recent call last): File "/home/lef/RecuperaBit-1.1.4/main.py", line 374, in main() File "/home/lef/RecuperaBit-1.1.4/main.py", line 357, in main parts.update(scanner.get_partitions()) File "/home/lef/RecuperaBit-1.1.4/recuperabit/fs/ntfs.py", line 695, in get_partitions parsed = parse_file_record(dump) File "/home/lef/RecuperaBit-1.1.4/recuperabit/fs/ntfs.py", line 149, in parse_file_record _apply_fixup_values(header, entry) File "/home/lef/RecuperaBit-1.1.4/recuperabit/fs/ntfs.py", line 102, in _apply_fixup_values entry[pos-2:pos] = entry[offset + 2i:offset + 2(i+1)] TypeError: 'bytes' object does not support item assignment