fkie-cad / fact_extractor

Standalone Utility for FACT-like extraction
GNU General Public License v3.0
80 stars 31 forks source link

Error unpacking raw filesystem images with invalid partitions #76

Closed Caesurus closed 3 years ago

Caesurus commented 3 years ago

Currently I have a raw disk with multiple partitions. However one partition doesn't contain a valid fs (EG, if there is a start of a valid partition, but the file is truncated). This causes kpartx to only enumerate the valid partition but still throw an error. So the genericFS plugin doesn't process the correct partitions at all and just exits. This then results in binwalk being unleashed, which of course ends badly ;)

sample:

add map loop0p1 (253:0): 0 4096 linear 7:0 2048
add map loop0p2 (253:1): 0 6144 linear 7:0 6144
add map loop0p3 (253:2): 0 4096 linear 7:0 12288
device-mapper: reload ioctl on loop0p4  failed: Invalid argument
create/reload failed on loop0p4

Creating this Issue so that there is a record of it. I have updated mbr.img file to test for the issue. I will fix the code to ensure the existing tests pass and submit a PR shortly.