search

Lazza / RecuperaBit

A tool for forensic file system reconstruction.
GNU General Public License v3.0
517 stars 73 forks source link

OSError: [Errno 22] Invalid argument #86

Closed hippie-dude closed 3 years ago

hippie-dude commented 3 years ago

I am attempting to recover files from a hard drive image, but I repeatedly receive the same error after completing the first scan. I run:

py main.py -s SAVE -o D:\Recovery\Restored D:\Recovery\sdb.img

And after the scan completes, this is outputted to the command prompt:

INFO:root:First scan completed INFO:root:Parsing MFT entries Traceback (most recent call last): File "D:\RecuperaBit-1.1.5\main.py", line 374, in main() File "D:\RecuperaBit-1.1.5\main.py", line 357, in main parts.update(scanner.get_partitions()) File "D:\RecuperaBit-1.1.5\recuperabit\fs\ntfs.py", line 695, in get_partitions parsed = parse_file_record(dump) File "D:\RecuperaBit-1.1.5\recuperabit\fs\ntfs.py", line 151, in parse_file_record attributes = _attributes_reader(entry, header['off_first']) File "D:\RecuperaBit-1.1.5\recuperabit\fs\ntfs.py", line 110, in _attributes_reader attr, name = parse_mft_attr(entry[offset:]) File "D:\RecuperaBit-1.1.5\recuperabit\fs\ntfs.py", line 91, in parse_mft_attr data = unpack(content[:size], attr_types_fmt[name]) File "D:\RecuperaBit-1.1.5\recuperabit\utils.py", line 89, in unpack result[label] = formatter(data[low:high+1]) File "D:\RecuperaBit-1.1.5\recuperabit\fs\ntfs_fmt.py", line 81, in index_root_parser entries = index_entries(dump[offset:]) File "D:\RecuperaBit-1.1.5\recuperabit\fs\ntfs_fmt.py", line 58, in index_entries parsed = unpack(dump[offset:], indx_dir_entry_fmt) File "D:\RecuperaBit-1.1.5\recuperabit\utils.py", line 89, in unpack result[label] = formatter(data[low:high+1]) File "D:\RecuperaBit-1.1.5\recuperabit\fs\ntfs_fmt.py", line 127, in try_filename unpack(dump, attr_types_fmt['$FILE_NAME']) File "D:\RecuperaBit-1.1.5\recuperabit\utils.py", line 89, in unpack result[label] = formatter(data[low:high+1]) File "D:\RecuperaBit-1.1.5\recuperabit\fs\ntfs_fmt.py", line 47, in windows_time converted = datetime.utcfromtimestamp(value/10.**7 - 11644473600) OSError: [Errno 22] Invalid argument

I am using Python 3.9.2.

Lazza commented 3 years ago

Thank you for bringing this up. It seems that utcfromtimestamp can produce OSError on Windows.

Please try with the latest commit.