Lazza / RecuperaBit

A tool for forensic file system reconstruction.
GNU General Public License v3.0
517 stars 73 forks source link

First run fails on AttributeError #81

Closed jarda-wien closed 3 years ago

jarda-wien commented 3 years ago

Hello,

I tried to use RecuperaBit using the latest docker image as described on a myrescue - created image file:

file /mnt/data_raid/malatek.backup
/mnt/data_raid/malatek.backup: DOS/MBR boot sector, code offset 0x52+2, OEM-ID "NTFS    ", sectors/cluster 8, Media descriptor 0xf8, sectors/track 63, heads 255, hidden sectors 2048, dos < 4.0 BootSector (0x80), FAT (1Y bit by descriptor); NTFS, sectors/track 63, sectors 976705535, $MFT start cluster 786432, $MFTMirror start cluster 61044095, bytes/RecordSegment 2^(-1*246), clusters/index block 1, serial number 0b4d48115d480db4e; contains bootstrap NTLDR

The first run failed with the following stack trace:

INFO:root:Adding extra attributes from $ATTRIBUTE_LIST
Traceback (most recent call last):
  File "/recuperabit/main.py", line 374, in <module>
    main()
  File "/recuperabit/main.py", line 357, in main
    parts.update(scanner.get_partitions())
  File "/recuperabit/recuperabit/fs/ntfs.py", line 836, in get_partitions
    self.finalize_reconstruction(part)
  File "/recuperabit/recuperabit/fs/ntfs.py", line 672, in finalize_reconstruction
    self.add_from_attribute_list(parsed, part, node.offset)
  File "/recuperabit/recuperabit/fs/ntfs.py", line 627, in add_from_attribute_list
    _integrate_attribute_list(parsed, part, image)
  File "/recuperabit/recuperabit/fs/ntfs.py", line 238, in _integrate_attribute_list
    (len(files) == 1 and iter(files).next() == base_record)
AttributeError: 'setiterator' object has no attribute 'next'

This is RecuperaBit 1.1.2 as reported by the initial banner.

NicolasCARPi commented 3 years ago

What's your python version?

Lazza commented 3 years ago

Please try the latest release (v1.1.4) and report if you get the same error.

Thank you!

Lazza commented 3 years ago

I verified and the offending code was already fixed in later versions.