Thread panick when parsing with USNJournal

[ker422]

Hi,

I've been having an issue lately with many $MFT I tried to parse when parsing with USNJournal. Command line:

mft2bodyfile -O fs.test.body -J C.UsnJrnl.J C.MFT

In which:

• C.MFT : Is the MFT
• C.UsnJrnl.J : Is the USNJournal related to the $MFT

Error:

[00:00:01] ######----------------------------------     79000/609536   (13%) parsing $MFT entries
[00:00:01] |                                            33000 parsing $UsnJrnl:$J entries
thread '<unnamed>' panicked at 'assertion failed: `(left == right)`
  left: `182598`,
[00:00:07] ########################################    609536/609536   (100%) parsing $MFT entries
thread 'main' panicked at 'called `Result::unwrap()` on an `Err` value: Any { .. }', src/lib.rs:171:45

Version:

• mft2bodyfile: mft2bodyfile 0.7.0
• rustc: rustc 1.59.0

No error occurred when running without the USNJournal.

Any idea why would this happen ?

[janstarke]

This is a problem that occurs when usnjrnl reaches the end of $UsnJrnl:$J

[janstarke]

I think this should be fixed since v0.7.1. Could you please give it a try with your data?

[ker422]

Hi,

I made several tests and I confirm that the issue is resolved.

Thanks.