search

Shadyred75 / wombatforensics

Automatically exported from code.google.com/p/wombatforensics
0 stars 0 forks source link

Errors when processing ntfs_pract.e01. #113

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago 
3 errors related to failure to open partition filesytem. also segfaults when 
trying to view the files in the hexeditor.

readimage error at reader.cpp:198 and setTopLeft hexeditor 206.

Original issue reported on code.google.com by pjrina...@gmail.com on 14 Jul 2014 at 2:19

GoogleCodeExporter commented 9 years ago 
working on this i progress through the property values.

Original comment by pjrina...@gmail.com on 14 Jul 2014 at 2:20

GoogleCodeExporter commented 9 years ago 
The 3 errors are probably in trying to add the partition table entry, the 
unallocated entry and the other unallocated entry. need to account for these 
and simply add the unallocated treenode and then call the read_fs_block(offset, 
length) for the editor.

Original comment by pjrina...@gmail.com on 14 Jul 2014 at 2:23

GoogleCodeExporter commented 9 years ago 
when creating the partition information in the tree, I need switch for the 
flags to hadndle each as necessary.

enum    TSK_VS_PART_FLAG_ENUM { TSK_VS_PART_FLAG_ALLOC = 0x01, 
TSK_VS_PART_FLAG_UNALLOC = 0x02, TSK_VS_PART_FLAG_META = 0x04, 
TSK_VS_PART_FLAG_ALL = 0x07 }

If 4, skip, if alloc 1, do normal, if unalloc 2, then write in the new code to 
handle it.

TSK_VS_PART_FLAG_ALLOC  Sectors are allocated to a volume in the volume system.
TSK_VS_PART_FLAG_UNALLOC Sectors are not allocated to a volume.
TSK_VS_PART_FLAG_META Sectors contain volume system metadata and could also be 
ALLOC or UNALLOC.
TSK_VS_PART_FLAG_ALL Show all sectors in the walk.

Original comment by pjrina...@gmail.com on 14 Jul 2014 at 2:31

GoogleCodeExporter commented 9 years ago 
solved the first set of errors and now display unallocated space. Need to work 
the selection changed functionality into the mix.

Original comment by pjrina...@gmail.com on 14 Jul 2014 at 4:24

GoogleCodeExporter commented 9 years ago 
combined partition and filesystem properly. now i need to fix the error in the 
treemodel->data, line 102...

Original comment by pjrina...@gmail.com on 14 Jul 2014 at 7:08

GoogleCodeExporter commented 9 years ago 
resolved issues regarding the unallocated space.

Original comment by pjrina...@gmail.com on 15 Jul 2014 at 1:52