search

csababarta / ntdsxtract

Active Directory forensic framework
http://www.ntdsxtract.com
GNU General Public License v3.0
311 stars 109 forks source link

v.1.3.3 - Error! 1369 #18

Open PukinDogs opened 8 years ago

PukinDogs commented 8 years ago

Ran this not long ago without issue under version 1.3.2 Updated today and the List of Users won't complete currently.

Command:

./dsusers.py ../../ntds.dit.export/datatable.3 ../../ntds.dit.export/link_table.5 workingfolder --syshive ../../SYSTEM --lmoutfile lmoutfile.txt --ntoutfile ntoutfile.txt -- pwdformat ophc --passwordhashes --passwordhistory

... [+] Loading Saved map files (Stage 2)...

List of users: ==========[!] Error! 1369

csababarta commented 8 years ago

It seems that the framework is not able to load the cached data from the work directory. You can delete the content of the work directory and have the framework reprocess the data tables. After deleting the content you can rerun the command and the framework will reprocess everything and recreate the caches.

PukinDogs commented 8 years ago

I deleted the working folder and reran the command. Same error.

There are two warnings to note however:

[!] Warning: Opening saved maps failed: [Errno 2] No such file or directory: '/mnt/WorkingFolder/offlid.map'

[!] Warning: Opening saved maps failed: [Errno 2] No such file or directory: '/mnt/WorkingFolder/links.map'

Then the same Error 1369. Hope that helps.

PukinDogs commented 8 years ago

I did check the folder to confirm those files exist and they are created.

csababarta commented 8 years ago

In this case those messages are only warnings, meaning that the framework did not find the files. As the working directory was empty (you deleted all the file from it), the framework recreated all the cache files. That is why you saw them. I think everything should be working for you now. Let me know if the framework could process the data tables.

PukinDogs commented 8 years ago

Even after deleting the folder, it still stalls at the same point as my first post.

I'm looking to verify the esedbexport is working properly. Then I'll try it again tomorrow, I did notice this libesedb is listed as experimental. Maybe thats the issue. I'm using "libesedb-20150409"

PukinDogs commented 8 years ago

rolling back to esedbexport (20141110) did not resolve the issue. Not sure what else to try here, could I get a copy of the previous version of NTDsXtract 1.3.2?