search

libyal / libewf-legacy

Legacy version of libewf
GNU Lesser General Public License v3.0
10 stars 5 forks source link

libcdata_internal_array_resize: invalid entries size value exceeds maximum. #15

Closed esp13 closed 2 years ago

esp13 commented 3 years ago

I saved a suspected defective external drive with guymager. (To ewf image : multiple E01, E02, E03, etc, Exx files)

I can mount the RAW data of the backup on my linux mint 19.02 computer with xmount v0.7.3:

xmount --version

WARNING: Your system does not seem to have a "fuse" group. If mounting works, you can ignore this message.

WARNING: FUSE will not allow other users nor root to access your virtual harddisk image. To change this behavior, please add "user_allow_other" to /etc/fuse.conf or execute xmount as root.

xmount v0.7.3 Copyright (c) 2008-2014 by Gillen Daniel <gillen.dan@pinguin.lu>

  compile timestamp: Apr  3 2018 12:52:49
  gcc version: 7.3.0
  loaded input libraries:
    - libxmount_input_aaff.so supporting "aaff"
    - libxmount_input_aff.so supporting "aff"
    - libxmount_input_aewf.so supporting "aewf"
    - libxmount_input_raw.so supporting "raw", "dd"
    - libxmount_input_ewf.so supporting "ewf"
  loaded morphing libraries:
    - libxmount_morphing_raid.so supporting "raid0"
    - libxmount_morphing_unallocated.so supporting "unallocated"
    - libxmount_morphing_combine.so supporting "combine"

But not on an other computer on a linux mint 20.2 USB live with xmount v0.7.6.

xmount --version

WARNING: FUSE will not allow other users nor root to access your virtual harddisk image. To change this behavior, please add "user_allow_other" to /etc/fuse.conf or execute xmount as root.

xmount v0.7.6 Copyright (c) 2008-2018 by Gillen Daniel <gillen.dan@pinguin.lu>

  compile timestamp: Sep  2 2018 12:00:15
  gcc version: 8.2.0
  loaded input libraries:
    - libxmount_input_raw.so supporting "raw", "dd"
    - libxmount_input_ewf.so supporting "ewf"
    - libxmount_input_aff.so supporting "aff"
    - libxmount_input_aewf.so supporting "aewf"
    - libxmount_input_aaff.so supporting "aaff"
  loaded morphing libraries:
    - libxmount_morphing_unallocated.so supporting "unallocated"
    - libxmount_morphing_raid.so supporting "raid0"
    - libxmount_morphing_combine.so supporting "combine"

I get this error:

sudo xmount --in ewf /media/veracrypt1/xxx.E?? --out raw /home/mint/mntxxxRAW/
ERROR: main@3692 : Unable to open input image file '/media/veracrypt1/xxx.E01': Unable to open EWF file(s)!

I have this strange behavior only with this specific drive image. All other drives images I have done the same way on the same day, are working with both versions of xmount. This drive is the larger one 1TB for 870GB total of image files (2.1GB files).

Maybe this doesn't comes directly from xmount : on the computer with the 0.7.6 xmount version, I tried it with ewfmount (20140807 version):

ewfmount /media/veracrypt1/xxx.E01 /home/mint/mntxxxRAW/

And get this error: 

Unable to open source image(s)
libcdata_internal_array_resize: invalid entries size value exceeds maximum.
libcdata_array_resize: unable to resize array.
libmfdata_list_resize: unable to resize elements array.
libewf_segment_file_read_volume_section: unable to resize chunk table list.
libewf_handle_open_read_segment_files: unable to read section: volume.
libewf_handle_open_file_io_pool: unable to read segment files.
libewf_handle_open: unable to open handle using a file IO pool.
mount_handle_open: unable to open file(s).

On the computer where it works:

apt-cache policy libewf2
libewf2:
  Installé : 20140608-6.1build1

apt-cache policy ewf-tools
ewf-tools:
  Installé : 20140608-6.1build1

On the computer where it doesn't works:

apt-cache policy libewf2
libewf2:
  Installé : 20140807-2build1

apt-cache policy ewf-tools
ewf-tools:
  Installé : 20140807-2build1

Any idea why it works on older version but not on newer?

I found this issues talking about similar problems:

But I'm too noob to understand what to do or to install an other version. Could you please drive me?

Thanks for having read, Sorry for my bad English level :/

joachimmetz commented 3 years ago

Since you used 20140807 try a more recent version https://github.com/libyal/libewf-legacy/releases

joachimmetz commented 3 years ago

If you need instructions on how to build from source https://github.com/libyal/libewf/wiki/Building. However these instructions assume some knowledge of building binaries from source.

esp13 commented 3 years ago

Since you used 20140807 try a more recent version https://github.com/libyal/libewf-legacy/releases

Thank you for your answer. By curiosity why the ubuntu/mint repo version is so outdated?

I downloaded the last version 20210426 and compiled it, now ewfinfo doesn't give an error any more on this big disk image :)

Ewfmount gives now an other error: No sub system to mount EWF format.

I suppose that is a fuse related error?

Building:
   libcerror support:                        local
   libcthreads support:                      local
   libcdata support:                         local
   libcdatetime support:                     local
   libclocale support:                       local
   libcnotify support:                       local
   libcsplit support:                        local
   libuna support:                           local
   libcfile support:                         local
   libcpath support:                         local
   libbfio support:                          local
   libfcache support:                        local
   libfdata support:                         local
   libfdatetime support:                     local
   libfguid support:                         local
   libfvalue support:                        local
   ADLER32 checksum support:                 local
   DEFLATE compression support:              local
   BZIP2 compression support:                no
   libhmac support:                          local
   MD5 support:                              local
   SHA1 support:                             local
   SHA256 support:                           local
   libcaes support:                          local
   libodraw support:                         local
   libsmdev support:                         local
   libsmraw support:                         local
   GUID/UUID support:                        check
   FUSE support:                             no

Features:
   Multi-threading support:                  pthread
   Wide character type support:              no
   Write support:                            no
   ewftools are build as static executables: no
   Python (pyewf) support:                   no
   Verbose output:                           no
   Debug output:                             no

Maybe I just should do a sudo apt install libfuse-dev? The version of libfuse2 I already have on my computer:

libfuse2:
  Installé : 2.9.9-3

PS : I didn't find in the wiki / the man nor the help (-h) the explanation for the options (-X) that can be used with ewfmount.

PS2: Why an older version 20140608-6.1build1 work out of the box with this big disk image while the newer (but still old) version 20140807-2build1 gives an error?

PS3: I didn't find how to uninstall the manual installation in the wiki, it could be usefully (But I don't know I'm a beginner)

esp13 commented 3 years ago

I installed libfuse-dev, now I have:

Building:
   libcerror support:                        local
   libcthreads support:                      local
   libcdata support:                         local
   libcdatetime support:                     local
   libclocale support:                       local
   libcnotify support:                       local
   libcsplit support:                        local
   libuna support:                           local
   libcfile support:                         local
   libcpath support:                         local
   libbfio support:                          local
   libfcache support:                        local
   libfdata support:                         local
   libfdatetime support:                     local
   libfguid support:                         local
   libfvalue support:                        local
   ADLER32 checksum support:                 local
   DEFLATE compression support:              local
   BZIP2 compression support:                no
   libhmac support:                          local
   MD5 support:                              local
   SHA1 support:                             local
   SHA256 support:                           local
   libcaes support:                          local
   libodraw support:                         local
   libsmdev support:                         local
   libsmraw support:                         local
   GUID/UUID support:                        check
   FUSE support:                             libfuse

Features:
   Multi-threading support:                  pthread
   Wide character type support:              no
   Write support:                            no
   ewftools are build as static executables: no
   Python (pyewf) support:                   no
   Verbose output:                           no
   Debug output:                             no

But I still have the same No sub system to mount EWF format. error.

joachimmetz commented 3 years ago

By curiosity why the ubuntu/mint repo version is so outdated?

That is outside the control of this project and related to the ubuntu/mint repo, I recommend to file a bug with them.

PS : I didn't find in the wiki / the man nor the help (-h) the explanation for the options (-X) that can be used with ewfmount.

-X are fuse specific options see https://man7.org/linux/man-pages/man8/mount.fuse3.8.html, and differ per fuse version, typically used for passing allow_root

But I still have the same No sub system to mount EWF format. error.

This is explained here https://github.com/libyal/libewf/wiki/Mounting#mounting, you need to install fuse and fuse-dev and rebuild from source.

PS3: I didn't find how to uninstall the manual installation in the wiki, it could be usefully (But I don't know I'm a beginner)

make uninstall

PS2: Why an older version 20140608-6.1build1 work out of the box with this big disk image while the newer (but still old) version 20140807-2build1 gives an error?

because you're hitting a limit that was introduced between those versions

esp13 commented 3 years ago

That is outside the control of this project and related to the ubuntu/mint repo, I recommend to file a bug with them.

Oh ok. I could try, can you help me to do so? Where should I start? Here for ubuntu? https://bugs.launchpad.net/ubuntu/+source/libewf/+filebug Here for linux mint? https://forums.linuxmint.com/viewforum.php?f=47

-X are fuse specific options see https://man7.org/linux/man-pages/man8/mount.fuse3.8.html, and differ per fuse version, typically used for passing allow_root

Oh ok, maybe for noob like me the help should return -X: extended options to pass to fuse sub system (refer to fusion options) But I guess "sub system" is sufficient for experimented users?

This is explained here https://github.com/libyal/libewf/wiki/Mounting#mounting, you need to install fuse and fuse-dev and rebuild from source.

I started again from the beginning this worked great thank you :)

make uninstall

I started with this, it worked great, thank you. Is this way usual for most program compilation?

because you're hitting a limit that was introduced between those versions

I suppose this limit has/had an aim, how can I find what it is? Is there a risk by using an old version that hasn't this limit?

joachimmetz commented 3 years ago

Where should I start?

if Linux mint is your distro start here: https://projects.linuxmint.com/reporting-an-issue.html

Oh ok, maybe for noob like me the help should return -X: extended options to pass to fuse sub system (refer to fusion options)

"sub system" can be fuse, macfuse, DokanX, DokanY maybe fuse3 in the future. Adding "fuse" might help you in this specific case, but I'm sure there will be others that still will not understand it. These tools are not intended for a broad audience of users.

Is this way usual for most program compilation?

No, only mostly those that use autotools

I suppose this limit has/had an aim, how can I find what it is?

Yes to limit maximum memory usage.

Is there a risk by using an old version that hasn't this limit?

Yes consuming too much memory and potentially bring your system to a halt