libyal / libesedb

Library and tools to access the Extensible Storage Engine (ESE) Database File (EDB) format.
GNU Lesser General Public License v3.0
341 stars 91 forks source link

esedbexport can't export datatable #39

Closed bsdwiz closed 5 years ago

bsdwiz commented 6 years ago

Has anyone seen these errors? It only fails on the datatable - other tables will export successfully. I've also tried with the latest version and get the same errors. I'm not sure what's causing this and when ran in gdb there isn't a stacktrace. This is being ran on a CentOS.

root@myhost# esedbexport -T datatable ntds.dit
esedbexport 20120102

Opening file.
Exporting table 5 (datatable).
Unable to export file.
libesedb_page_tree_read_page: unsupported page flags: 0x9b42a802.
libesedb_page_tree_read_sub_nodes: unable to read page: 151006 at offset: 1237032960.
libfdata_tree_read_sub_nodes: unable to read sub nodes at offset: 1237032960.
libfdata_tree_node_read_leaf_node_values: unable to read sub nodes.
libfdata_tree_node_get_number_of_leaf_nodes: unable to retrieve node value.
libfdata_tree_node_read_leaf_node_values: unable to retrieve number of leaf nodes from sub node: 0.
libfdata_tree_node_get_number_of_leaf_nodes: unable to retrieve node value.
libfdata_tree_node_read_leaf_node_values: unable to retrieve number of leaf nodes from sub node: 0.
libfdata_tree_node_get_number_of_leaf_nodes: unable to retrieve node value.
libfdata_tree_get_number_of_leaf_nodes: unable to retrieve number of leaf nodes from root node.
libesedb_table_get_number_of_records: unable to retrieve number of leaf nodes from table values tree.
export_handle_export_table: unable to retrieve number of records.
joachimmetz commented 6 years ago
libesedb_page_tree_read_page: unsupported page flags: 0x9b42a802.

indicate unsupported format (page flags) any way you can share the file or debug output? also see: https://github.com/libyal/libesedb/wiki/Troubleshooting#verbose-and-debug-output

joachimmetz commented 5 years ago

Closing issue, cannot reproduce or troubleshoot without additional data from reporter.