Lazza / RecuperaBit

A tool for forensic file system reconstruction.
GNU General Public License v3.0
517 stars 73 forks source link

OverflowError #93

Closed TheBicPen closed 3 years ago

TheBicPen commented 3 years ago

I got an OverflowError when trying to recover a highly corrupted partition. Here's the traceback:

INFO:root:First scan completed
INFO:root:Saving results to /mnt/recuperabit-savefile
INFO:root:Parsing MFT entries
Traceback (most recent call last):
  File "main.py", line 374, in <module>
    main()
  File "main.py", line 357, in main
    parts.update(scanner.get_partitions())
  File "/home/user/RecuperaBit-1.1.5/recuperabit/fs/ntfs.py", line 695, in get_partitions
    parsed = parse_file_record(dump)
  File "/home/user/RecuperaBit-1.1.5/recuperabit/fs/ntfs.py", line 151, in parse_file_record
    attributes = _attributes_reader(entry, header['off_first'])
  File "/home/user/RecuperaBit-1.1.5/recuperabit/fs/ntfs.py", line 110, in _attributes_reader
    attr, name = parse_mft_attr(entry[offset:])
  File "/home/user/RecuperaBit-1.1.5/recuperabit/fs/ntfs.py", line 91, in parse_mft_attr
    data = unpack(content[:size], attr_types_fmt[name])
  File "/home/user/RecuperaBit-1.1.5/recuperabit/utils.py", line 89, in unpack
    result[label] = formatter(data[low:high+1])
  File "/home/user/RecuperaBit-1.1.5/recuperabit/fs/ntfs_fmt.py", line 81, in index_root_parser
    entries = index_entries(dump[offset:])
  File "/home/user/RecuperaBit-1.1.5/recuperabit/fs/ntfs_fmt.py", line 58, in index_entries
    parsed = unpack(dump[offset:], indx_dir_entry_fmt)
  File "/home/user/RecuperaBit-1.1.5/recuperabit/utils.py", line 89, in unpack
    result[label] = formatter(data[low:high+1])
  File "/home/user/RecuperaBit-1.1.5/recuperabit/fs/ntfs_fmt.py", line 127, in try_filename
    unpack(dump, attr_types_fmt['$FILE_NAME'])
  File "/home/user/RecuperaBit-1.1.5/recuperabit/utils.py", line 89, in unpack
    result[label] = formatter(data[low:high+1])
  File "/home/user/RecuperaBit-1.1.5/recuperabit/fs/ntfs_fmt.py", line 47, in windows_time
    converted = datetime.utcfromtimestamp(value/10.**7 - 11644473600)
OverflowError: timestamp out of range for platform time_t
TheBicPen commented 3 years ago

Oh I see that this was fixed since the last release. Ill try using the latest commit and report back.

TheBicPen commented 3 years ago

Seems to work in the latest commit.