Closed searay12399 closed 4 years ago
Libesedb Python fork?
what version or "Python fork" of libesedb are you using?
the messages table is actually a table of tables
what do you mean with this, can you share a sample or the output of esedbinfo?
Version is 20191220.
Also, here is a link that kinda explains the table that I am trying to read: http://cheeky4n6monkey.blogspot.com/2016/04/an-initial-peep-at-windows-10-mobile.html
If you scroll down to SMS/MMS, it talks about how the message table is set up. When I try to view the number of records in that table, it outputs the error that is shown above.
Is the database you are looking at dirty? What does esedbinfo tell you?
I dont know much about ese databases so I dont know how to tell if it is dirty. Also, how do I run esedbinfo? I tried finding an esedbinfo statement and found nothing.
A dirty database is a database that is not in a clean state (typically pending writes).
If you don't have built esedbinfo try Windows eseutil/esentutl (make sure to make a copy of the database first)
See here for some notes on eseutil/esentutl https://github.com/libyal/documentation/blob/master/Forensic%20analysis%20of%20the%20Windows%20Search%20database.pdf
Sorry for the delay. I ended up uploading the file to my Linux PC and ran esedbinfo on it. Here is the output:
Table 8, "Message," is what I am interested in.
@searay12399 thanks for that detail, unfortunately I do not see an indication if the database is dirty or not. I'll double check esedbinfo and add it if not there.
Seeing the error hint to a format related issue could you provide me with the file or format debug (see: https://github.com/libyal/libesedb/wiki/Troubleshooting#format-or-behavioral-errors) so I can take a closer look what might be causing the issue.
Reminder to add information about dirty state to esedbinfo tracked in https://github.com/libyal/libesedb/issues/52.
No additional information from original reporter closing issue.
Hi, I am trying to parse the store.vol file of a Windows phone. I was able to parse the contacts, but the messages table is actually a table of tables and returns an error:
"libesedb_table_get_number_of_records: unable to retrieve number of leaf values from table page tree."
How can I parse out the individual tables in the the messages table of the ESE Database? Is there a function to do this?