search

OWNsecurity / fastir_artifacts

Live forensic artifacts collector
https://medium.com/@Sekoia_team/introducing-fastir-artifacts-66f1d43fcac5
GNU General Public License v3.0
160 stars 17 forks source link

Invalid magic value in fastir\common\filesystem.py #1

Closed Tibap closed 5 years ago

Tibap commented 5 years ago

When running fastir_artifacts on my machine, it throws an error and execution is stopped.

Stacktrace is: 

.\fastir_artifacts.exe
2019-09-30 13:22:44,831 - PROGRESS - Loading artifacts ...
2019-09-30 13:22:46,327 - PROGRESS - Collecting artifacts from 55 sources ...
Traceback (most recent call last):
  File "fastir_artifacts.py", line 134, in <module>
  File "fastir_artifacts.py", line 115, in main
  File "fastir\common\collector.py", line 52, in collect
  File "fastir\common\filesystem.py", line 313, in collect
  File "fastir\common\filesystem.py", line 70, in collect
  File "fastir\common\path_components.py", line 93, in _generate
  File "fastir\common\path_components.py", line 93, in _generate
  File "fastir\common\filesystem.py", line 102, in _base_generator
OSError: Img_Info_Con: (tsk3.c:96) Unable to open image: Invalid magic value (raw_open: image "\\.\G:" - is a directory)
[5152] Failed to execute script fastir_artifacts

My G: drive is an NTFS Network drive.

gaelmuller commented 5 years ago

Thank you for reporting this issue. We will try to reproduce it to create a fix.

gaelmuller commented 5 years ago

This should be fixed. Could you try with the new release and let us know ?