Closed certxlm closed 1 year ago
Unfortunately, we cannot provide you with the encase files, but we hope that this issue helps.
Can you create a test file with this scenario you can share?
The encase file was made by another team, but we'll ask nonetheless, should be able to get an answer soon enough
This might be something specific to
Operating system used: TX1 20.2.0
Software version used: LIE 4.2.0
So L01/Lx01 does not appear to be a single format, there are L01 files generated by Encase that other tools fails to process. I strongly discourage using this format for anything serious. If you want better support for it in libewf, I'll need test files. Closing issue, reopen if there are test files.
Hello,
We recently encountered an issue with an encase logical image (2 files, Fx01 + Fx02). Neither ewfmount nor ewfinfo could make sense of it.
We work on Ubuntu 22.04, so at first we tried with the available version....
But a newer version (built from the tarball) failed as well:
After looking at the code (and adding some more debug), we realized that the issue lies in the _libewf_single_files_parse_utf8string function. More specifically, the function checks the number of categories (must be 5 of them), then proceed to parse them in a fixed order, starting with "libewf_single_files_parse_rec_category".
Strangely, in the files provided to us, the categories appear in this order:
To be able to work on our case, we made a quick and dirty patch that was functionnal enough. You can find it here with details on how the encase file was created. Note that the patch isn't good enough for a PR:
Unfortunately, we cannot provide you with the encase files, but we hope that this issue helps.