search

libyal / libewf

Libewf is a library to access the Expert Witness Compression Format (EWF)
GNU Lesser General Public License v3.0
264 stars 76 forks source link

how to get segment files that are > 2G ? #165

Closed SirHenryTheNerd closed 2 years ago

SirHenryTheNerd commented 2 years ago

Hi!

Since the latest update to macOS ewfacquire keeps throwing "Value not within specified range" when you enter a segment size that is larger than about 2 GB. I tried to re-compile the whole libewf but this error sticks.

Could you please have a look what could cause this?

joachimmetz commented 2 years ago

Can you provide more detail on how you built ewfacquire with which versions of Mac OS and Xcode?

SirHenryTheNerd commented 2 years ago

I built the 20201230 version quite a time ago (don't know when). Everything worked fine. Yesterday I made an update to 10.15.7 (Catalina) and after that I found 1.6 GB segments while having 8 GB hard-coded in the script I use. So I did some manual testing and found, that the -S parameter gets ignored when over (roughly) 2 GB.

So I downloaded everything from GitHub, recompiled using Xcode 12.4 on the 10.15.7 and nothing changed.

As everything has been working fine for months I really think this I connected to the latest macOS update.

Note: I remove the self-compiled version and installed an old ewflib version using Homebrew and it showed the same error.

Please tell if I can do some testing that helps find the bug.

joachimmetz commented 2 years ago
SirHenryTheNerd commented 2 years ago

It's an 2013 iMac. 10.15.7 is the latest supported version and I think it's not very smart to dump a working device just because it's old.

config.log is attached.

I tried ewf and ewfx. Both show the same error. config.log

joachimmetz commented 2 years ago

you might need encase6 (or later) output format since most versions of EWF formats before are limited to < 2G segment files

It's an 2013 iMac. 10.15.7 is the latest supported version and I think it's not very smart to dump a working device just because it's old.

ewfaquire is typically used to image disks, which is often faster on newer hardware, hence the question; should not change the situation too much

config.log

see no obvious limitations/issues there

SirHenryTheNerd commented 2 years ago

The strange thing is that it has been working for quite a while and just stopped after the update. I never changed anything (even not the segment size). From one day to another (after the update) it just stopped to work. I will give it a try using encase6.

SirHenryTheNerd commented 2 years ago

Ok, with encase6 it seems to work.

encase7 and encase7-v2: Evidence segment file size in bytes (1.0 MiB <= value <= 7.9 EiB) [1.4 GiB]: 8 GB Unsupported maximum segment size defaulting to: 1572864000.

Same with ewfx. Shouldn't this support 8 GB?

joachimmetz commented 2 years ago

encase7 and encase7-v2

might need to be still implemented, realize you're running an experimental / under-development version

Same with ewfx. Shouldn't this support 8 GB?

why ?

joachimmetz commented 2 years ago

The strange thing is that it has been working for quite a while and just stopped after the update. I never changed anything (even not the segment size). From one day to another (after the update) it just stopped to work.

impossible for me to assess what happened there, since I have no visibility on what happened on the system

SirHenryTheNerd commented 2 years ago

Thanks for your support!