joachimmetz
commented
3 years ago You are using an older version 20140806, use the latest legacy version (https://github.com/libyal/libewf-legacy) you are likely running into an issue that has already been addressed.
I have already acquired hardisk (linux-system) using guymager and saved with EWF format. I got trouble to mount the image file to mount point using ewfmount command. This is the error log: [root@ADIA forensics-test]# ewfmount /mnt/hgfs/OSI/DE01/serverRepo.E* /mnt/source/ ewfmount 20140806
Unable to open source image(s) libcdata_internal_array_resize: invalid entries size value exceeds maximum. libcdata_array_resize: unable to resize array. libmfdata_list_resize: unable to resize elements array. libewf_segment_file_read_volume_section: unable to resize chunk table list. libewf_handle_open_read_segment_files: unable to read section: volume. libewf_handle_open_file_io_pool: unable to read segment files. libewf_handle_open: unable to open handle using a file IO pool. mount_handle_open: unable to open file(s).
I tried to used the vmware from this https://forensics.cert.org/appliance/ADIA-CentOS7-x86_64-VMware.ova and https://forensics.cert.org/3-all_announcements.html sudo yum-config-manager --enable forensics-test
I am not use that already used the latest version This is the log: [root@ADIA forensics-test]# ewfmount -V ewfmount 20140806
Copyright (C) 2006-2019, Joachim Metz. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. Report bugs to joachim.metz@gmail.com.
Thank you for your help.