search

libyal / libpff

Library and tools to access the Personal Folder File (PFF) and the Offline Folder File (OFF) format
GNU Lesser General Public License v3.0
286 stars 74 forks source link

Running pffexport my@email.com.ost produces no exported items #11

Closed eoyslebo closed 9 years ago

eoyslebo commented 9 years ago

I have verified that the emails are in fact there, since they show up when I open the OST with an evaluation copy of Kernel for OST to PST.

Neither pffexport 20120802 or the latest git revision are able to export any items.

Output from running pffexport -v my@email.com.ost #(version 20120802):

Opening file.
Exporting items.
Unable to export file.
libpff_file_get_root_folder: invalid file - missing root folder item tree node.
export_handle_export_items: unable to retrieve root folder.
export_handle_export_file: unable to export items.

Output from running pffexport -v my@email.com.ost #(version 20150106, latest from git):

Opening file.
Exporting items.
Export completed.

Output from running pffexport -v -m all my@email.com.ost #(version 20150106, latest from git):

Opening file.
Recovering items.
Unable to export file.
libpff_index_read_node: index type mismatch (index: 0x81, node: 0x80).
libpff_index_read_sub_nodes: unable to read index node at offset: 3102077440.
libfdata_tree_read_sub_nodes: unable to read sub nodes at offset: 3102077440.
libfdata_tree_node_read_leaf_node_values: unable to read sub nodes.
libfdata_tree_node_get_number_of_deleted_leaf_nodes: unable to retrieve node value.
libfdata_tree_get_number_of_deleted_leaf_nodes: unable to retrieve number of deleted leaf nodes from root node.
libpff_recover_index_nodes: unable to retrieve number of deleted descriptor index values.
libpff_recover_items: unable to recover index nodes.
libpff_file_recover_items: unable to recover items.
export_handle_export_file: unable to recover items.

output from pffinfo -v my@email.com.ost #(version 20150106, latest from git):

Personal Folder File information:
        File size:              8499790848 bytes
        File content type:      Offline Storage Tables (OST)
        File type:              64-bit
        Encryption type:        compressible
eoyslebo commented 9 years ago

debug from running pffexport -v my@email.com.ost #(version 20150106, latest from git):

Reading file header:
libpff_io_handle_read_file_header: reading file header at offset: 0 (0x00000000)
libpff_io_handle_read_file_header: file header:
00000000: 21 42 44 4e b1 a8 5e b6  53 4f 17 00 0c 00 01 01   !BDN..^. SO......
00000010: 40 00 00 00 fb 89 63 74                            @.....ct 

libpff_io_handle_read_file_header: signature                : !BDN
libpff_io_handle_read_file_header: checksum             : 0xb65ea8b1
libpff_io_handle_read_file_header: content type             : SO
libpff_io_handle_read_file_header: data version             : 23
libpff_io_handle_read_file_header: content version          : 12
libpff_io_handle_read_file_header: creation platform            : 0x01
libpff_io_handle_read_file_header: access platform          : 0x01
libpff_io_handle_read_file_header: unknown1             : 0x00000040 (64)
libpff_io_handle_read_file_header: unknown2             : 0x746389fb (1952680443)

libpff_io_handle_read_file_header: file header data:
00000000: 04 00 00 00 01 00 00 00  59 41 35 00 00 00 00 00   ........ YA5.....
00000010: f3 59 06 00 00 04 00 00  40 00 0b 00 21 04 00 00   .Y...... @...!...
00000020: 04 40 00 00 44 59 01 00  9b 42 00 00 04 40 00 00   .@..DY.. .B...@..
00000030: 04 40 00 00 6f 80 00 00  07 04 00 00 00 04 00 00   .@..o... ........
00000040: 00 04 00 00 00 04 00 00  21 04 00 00 21 04 00 00   ........ !...!...
00000050: 21 04 00 00 04 40 00 00  00 04 00 00 00 04 00 00   !....@.. ........
00000060: 00 04 00 00 21 04 00 00  21 04 00 00 00 04 00 00   ....!... !.......
00000070: 00 04 00 00 00 04 00 00  0f 04 00 00 00 04 00 00   ........ ........
00000080: 00 04 00 00 00 04 00 00  00 04 00 00 00 04 00 00   ........ ........
00000090: 2f e0 00 00 00 00 00 00  0a 00 00 00 00 00 00 00   /....... ........
000000a0: 00 84 a0 fa 01 00 00 00  00 a4 9c fa 01 00 00 00   ........ ........
000000b0: c0 26 43 22 00 00 00 00  00 00 00 00 00 00 00 00   .&C".... ........
000000c0: 4b 41 35 00 00 00 00 00  00 f2 e5 b8 00 00 00 00   KA5..... ........
000000d0: 58 41 35 00 00 00 00 00  00 fc e5 b8 00 00 00 00   XA5..... ........
000000e0: 02 00 00 00 00 00 00 00  ff ff ff ff ff ff ff ff   ........ ........
000000f0: ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ........ ........
...
000001d0: ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ........ ........
000001e0: ff ff ff ff ff ff ff ff  80 01 00 00 c8 47 9a 00   ........ .....G..
000001f0: 00 00 00 00 c3 33 87 c6  73 0e b6 00 00 00 00 00   .....3.. s.......
00000200: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ........ ........
00000210: 00 00 00 00 00 00 00 00  00 00 00 00               ........ ....

libpff_io_handle_read_file_header: unknown3:
00000000: 04 00 00 00 01 00 00 00                            ........ 

libpff_io_handle_read_file_header: next index back pointer      : 3490137
libpff_io_handle_read_file_header: seed value               : 0x000659f3
libpff_io_handle_read_file_header: high water mark: 00 value        : 1024
libpff_io_handle_read_file_header: high water mark: 01 value        : 720960
libpff_io_handle_read_file_header: high water mark: 02 value        : 1057
libpff_io_handle_read_file_header: high water mark: 03 value        : 16388
libpff_io_handle_read_file_header: high water mark: 04 value        : 88388
libpff_io_handle_read_file_header: high water mark: 05 value        : 17051
libpff_io_handle_read_file_header: high water mark: 06 value        : 16388
libpff_io_handle_read_file_header: high water mark: 07 value        : 16388
libpff_io_handle_read_file_header: high water mark: 08 value        : 32879
libpff_io_handle_read_file_header: high water mark: 09 value        : 1031
libpff_io_handle_read_file_header: high water mark: 10 value        : 1024
libpff_io_handle_read_file_header: high water mark: 11 value        : 1024
libpff_io_handle_read_file_header: high water mark: 12 value        : 1024
libpff_io_handle_read_file_header: high water mark: 13 value        : 1057
libpff_io_handle_read_file_header: high water mark: 14 value        : 1057
libpff_io_handle_read_file_header: high water mark: 15 value        : 1057
libpff_io_handle_read_file_header: high water mark: 16 value        : 16388
libpff_io_handle_read_file_header: high water mark: 17 value        : 1024
libpff_io_handle_read_file_header: high water mark: 18 value        : 1024
libpff_io_handle_read_file_header: high water mark: 19 value        : 1024
libpff_io_handle_read_file_header: high water mark: 20 value        : 1057
libpff_io_handle_read_file_header: high water mark: 21 value        : 1057
libpff_io_handle_read_file_header: high water mark: 22 value        : 1024
libpff_io_handle_read_file_header: high water mark: 23 value        : 1024
libpff_io_handle_read_file_header: high water mark: 24 value        : 1024
libpff_io_handle_read_file_header: high water mark: 25 value        : 1039
libpff_io_handle_read_file_header: high water mark: 26 value        : 1024
libpff_io_handle_read_file_header: high water mark: 27 value        : 1024
libpff_io_handle_read_file_header: high water mark: 28 value        : 1024
libpff_io_handle_read_file_header: high water mark: 29 value        : 1024
libpff_io_handle_read_file_header: high water mark: 30 value        : 1024
libpff_io_handle_read_file_header: high water mark: 31 value        : 57391

libpff_io_handle_read_file_header: unknown4:
00000000: 00 00 00 00 0a 00 00 00                            ........ 

libpff_io_handle_read_file_header: file header data root:
libpff_io_handle_read_file_header: unknown5:
00000000: 00 00 00 00                                        ....

libpff_io_handle_read_file_header: file size                : 8499790848
libpff_io_handle_read_file_header: last data allocation table offset    : 8499536896
libpff_io_handle_read_file_header: total available data size        : 574826176
libpff_io_handle_read_file_header: total available page size        : 0
libpff_io_handle_read_file_header: descriptors index back pointer   : 3490123
libpff_io_handle_read_file_header: descriptors index root node offset   : 3102077440
libpff_io_handle_read_file_header: offsets index back pointer       : 3490136
libpff_io_handle_read_file_header: offsets index root node offset   : 3102080000
libpff_io_handle_read_file_header: allocation table validation type : 0x02
libpff_io_handle_read_file_header: unknown6:
00000000: 00 00 00                                           ...

libpff_io_handle_read_file_header: unknown7:
00000000: 00 00 00                                           ...

libpff_io_handle_read_file_header: initial data free map:
00000000: ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ........ ........
...
00000070: ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ........ ........

libpff_io_handle_read_file_header: initial page free map:
00000000: ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ........ ........
...
00000070: ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff   ........ ........

libpff_io_handle_read_file_header: sentinal             : 0x80
libpff_io_handle_read_file_header: encryption type          : 0x01
libpff_io_handle_read_file_header: unknown8:
00000000: 00 00                                              ..

libpff_io_handle_read_file_header: next index pointer           : 0
libpff_io_handle_read_file_header: checksum             : 0xc68733c3
libpff_io_handle_read_file_header: unknown11:
00000000: 73 0e b6                                           s..

libpff_io_handle_read_file_header: unknown12:
00000000: ff                                                 .

libpff_io_handle_read_file_header: unknown13:
00000000: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ........ ........
00000010: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ........ ........

libfdata_vector_append_segment: segment: 000    file index: 000 offset: 0x00000000 - 0x1faa08400 (size: 8499790848)
libfdata_vector_append_segment: segment: 000    mapped range: 0x00000000 - 0x1faa08400 (size: 8499790848)

Creating item tree:
libfdata_tree_get_node_value: cache: 0x019148e0 miss (entry: 1, want: 1, got: -1)
libfdata_tree_get_node_value: reading node at offset: 1 (0x00000001) of size: 0
libfdata_tree_get_node_value: cache: 0x019148e0 hit (entry: 1)
libfdata_vector_get_element_index_at_offset: requested offset: 0xb8e5f200
libfdata_vector_get_element_index_at_offset: segment: 000   mapped range: 0x00000000 - 0x1faa08400 (size: 8499790848)
libfdata_vector_get_element_index_at_offset: segment: 000   file index: 000 offset: 0x00000000 - 0x1faa08400 (size: 8499790848)

libfdata_vector_get_element_value_by_index: cache: 0x018f4640 miss (13049 out of 16384)
libfdata_vector_get_element_value_by_index: reading element data at offset: 3102077440 (0xb8e5f200) of size: 512
libpff_index_node_read: reading index node data at offset: 3102077440 (0xb8e5f200)
libpff_index_node_read: index node data:
00000000: 80 c2 06 00 00 00 00 00  00 86 f1 1b 00 00 00 00   ........ ........
00000010: f0 1f 02 00 00 84 f1 1b  ac c2 06 00 00 00 00 00   ........ ........
00000020: 00 a8 f2 1b 00 00 00 00  6c 0d 02 00 00 84 f1 1b   ........ l.......
00000030: b2 c2 06 00 00 00 00 00  00 4b ee 1b 00 00 00 00   ........ .K......
00000040: 38 00 02 00 b4 26 b6 09  bc c2 06 00 00 00 00 00   8....&.. ........
00000050: 00 94 ef 1b 00 00 00 00  24 03 02 00 b4 26 b6 09   ........ $....&..
00000060: c0 c2 06 00 00 00 00 00  80 96 f2 1b 00 00 00 00   ........ ........
00000070: 60 11 02 00 00 84 f1 1b  08 c3 06 00 00 00 00 00   `....... ........
00000080: 80 f5 f2 1b 00 00 00 00  e0 0e 02 00 00 84 f1 1b   ........ ........
00000090: 1a c3 06 00 00 00 00 00  80 4b ee 1b 00 00 00 00   ........ .K......
000000a0: 18 00 02 00 b4 26 b6 09  1c c3 06 00 00 00 00 00   .....&.. ........
000000b0: 80 24 f3 1b 00 00 00 00  4a 19 02 00 00 84 f1 1b   .$...... J.......
000000c0: 20 c3 06 00 00 00 00 00  80 04 f3 1b 00 00 00 00    ....... ........
000000d0: f0 1f 02 00 00 84 f1 1b  26 c3 06 00 00 00 00 00   ........ &.......
000000e0: 40 1d ee 1b 00 00 00 00  50 00 02 00 b4 26 b6 09   @....... P....&..
000000f0: 34 c3 06 00 00 00 00 00  80 f1 ef 1b 00 00 00 00   4....... ........
00000100: 5c 05 02 00 b4 26 b6 09  38 c3 06 00 00 00 00 00   \....&.. 8.......
00000110: 00 d0 f1 1b 00 00 00 00  7c 0e 02 00 00 84 f1 1b   ........ |.......
00000120: 3e c3 06 00 00 00 00 00  80 0b ee 1b 00 00 00 00   >....... ........
00000130: 18 00 01 00 b4 26 b6 09  40 c3 06 00 00 00 00 00   .....&.. @.......
00000140: 80 d5 f2 1b 00 00 00 00  f0 1f 01 00 00 84 f1 1b   ........ ........
00000150: 52 c3 06 00 00 00 00 00  00 00 ef 1b 00 00 00 00   R....... ........
00000160: 18 01 01 00 90 a6 5f 0e  52 c3 06 00 00 00 00 00   ......_. R.......
00000170: 00 00 ef 1b 00 00 00 00  18 01 02 00 90 a6 5f 0e   ........ ......_.
00000180: 52 c3 06 00 00 00 00 00  00 00 ef 1b 00 00 00 00   R....... ........
00000190: 18 01 02 00 90 a6 5f 0e  52 c3 06 00 00 00 00 00   ......_. R.......
000001a0: 00 00 ef 1b 00 00 00 00  18 01 02 00 90 a6 5f 0e   ........ ......_.
000001b0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ........ ........
...
000001d0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ........ ........
000001e0: 00 00 00 00 00 00 00 00  0c 14 18 00 00 00 00 00   ........ ........
000001f0: 80 80 19 a1 a4 cb b3 ee  c9 eb 35 00 00 00 00 00   ........ ..5.....

libpff_index_node_read: number of entries               : 12
libpff_index_node_read: maximum number of entries           : 20
libpff_index_node_read: entry size                  : 24
libpff_index_node_read: node level                  : 0
libpff_index_node_read: padding:
00000000: 00 00 00 00                                        ....

libpff_index_node_read: index node type                 : 0x80
libpff_index_node_read: index node type copy                : 0x80
libpff_index_node_read: signature                   : 0xa119
libpff_index_node_read: checksum                    : 0xeeb3cba4
libpff_index_node_read: back pointer                    : 0x0035ebc9

libpff_index_node_read: entry: 000 index node identifier        : 0x0006c280 (443008)
libpff_index_node_read: entry: 000 file offset              : 0x1bf18600 (468813312)
libpff_index_node_read: entry: 000 data size                : 8176
libpff_index_node_read: entry: 000 reference count          : 2
libpff_index_node_read: entry: 000 data allocation table offset     : 0x1bf18400 (468812800)
libpff_index_node_read: entry: 001 index node identifier        : 0x0006c2ac (443052)
libpff_index_node_read: entry: 001 file offset              : 0x1bf2a800 (468887552)
libpff_index_node_read: entry: 001 data size                : 3436
libpff_index_node_read: entry: 001 reference count          : 2
libpff_index_node_read: entry: 001 data allocation table offset     : 0x1bf18400 (468812800)
libpff_index_node_read: entry: 002 index node identifier        : 0x0006c2b2 (443058)
libpff_index_node_read: entry: 002 file offset              : 0x1bee4b00 (468601600)
libpff_index_node_read: entry: 002 data size                : 56
libpff_index_node_read: entry: 002 reference count          : 2
libpff_index_node_read: entry: 002 data allocation table offset     : 0x09b626b4 (162932404)
libpff_index_node_read: entry: 003 index node identifier        : 0x0006c2bc (443068)
libpff_index_node_read: entry: 003 file offset              : 0x1bef9400 (468685824)
libpff_index_node_read: entry: 003 data size                : 804
libpff_index_node_read: entry: 003 reference count          : 2
libpff_index_node_read: entry: 003 data allocation table offset     : 0x09b626b4 (162932404)
libpff_index_node_read: entry: 004 index node identifier        : 0x0006c2c0 (443072)
libpff_index_node_read: entry: 004 file offset              : 0x1bf29680 (468883072)
libpff_index_node_read: entry: 004 data size                : 4448
libpff_index_node_read: entry: 004 reference count          : 2
libpff_index_node_read: entry: 004 data allocation table offset     : 0x1bf18400 (468812800)
libpff_index_node_read: entry: 005 index node identifier        : 0x0006c308 (443144)
libpff_index_node_read: entry: 005 file offset              : 0x1bf2f580 (468907392)
libpff_index_node_read: entry: 005 data size                : 3808
libpff_index_node_read: entry: 005 reference count          : 2
libpff_index_node_read: entry: 005 data allocation table offset     : 0x1bf18400 (468812800)
libpff_index_node_read: entry: 006 index node identifier        : 0x0006c31a (443162)
libpff_index_node_read: entry: 006 file offset              : 0x1bee4b80 (468601728)
libpff_index_node_read: entry: 006 data size                : 24
libpff_index_node_read: entry: 006 reference count          : 2
libpff_index_node_read: entry: 006 data allocation table offset     : 0x09b626b4 (162932404)
libpff_index_node_read: entry: 007 index node identifier        : 0x0006c31c (443164)
libpff_index_node_read: entry: 007 file offset              : 0x1bf32480 (468919424)
libpff_index_node_read: entry: 007 data size                : 6474
libpff_index_node_read: entry: 007 reference count          : 2
libpff_index_node_read: entry: 007 data allocation table offset     : 0x1bf18400 (468812800)
libpff_index_node_read: entry: 008 index node identifier        : 0x0006c320 (443168)
libpff_index_node_read: entry: 008 file offset              : 0x1bf30480 (468911232)
libpff_index_node_read: entry: 008 data size                : 8176
libpff_index_node_read: entry: 008 reference count          : 2
libpff_index_node_read: entry: 008 data allocation table offset     : 0x1bf18400 (468812800)
libpff_index_node_read: entry: 009 index node identifier        : 0x0006c326 (443174)
libpff_index_node_read: entry: 009 file offset              : 0x1bee1d40 (468589888)
libpff_index_node_read: entry: 009 data size                : 80
libpff_index_node_read: entry: 009 reference count          : 2
libpff_index_node_read: entry: 009 data allocation table offset     : 0x09b626b4 (162932404)
libpff_index_node_read: entry: 010 index node identifier        : 0x0006c334 (443188)
libpff_index_node_read: entry: 010 file offset              : 0x1beff180 (468709760)
libpff_index_node_read: entry: 010 data size                : 1372
libpff_index_node_read: entry: 010 reference count          : 2
libpff_index_node_read: entry: 010 data allocation table offset     : 0x09b626b4 (162932404)
libpff_index_node_read: entry: 011 index node identifier        : 0x0006c338 (443192)
libpff_index_node_read: entry: 011 file offset              : 0x1bf1d000 (468832256)
libpff_index_node_read: entry: 011 data size                : 3708
libpff_index_node_read: entry: 011 reference count          : 2
libpff_index_node_read: entry: 011 data allocation table offset     : 0x1bf18400 (468812800)

libpff_index_node_read: remaining node entries
libpff_index_node_read: entry: 012 index node identifier        : 0x0006c33e (443198)
libpff_index_node_read: entry: 012 file offset              : 0x1bee0b80 (468585344)
libpff_index_node_read: entry: 012 data size                : 24
libpff_index_node_read: entry: 012 reference count          : 1
libpff_index_node_read: entry: 012 data allocation table offset     : 0x09b626b4 (162932404)
libpff_index_node_read: entry: 013 index node identifier        : 0x0006c340 (443200)
libpff_index_node_read: entry: 013 file offset              : 0x1bf2d580 (468899200)
libpff_index_node_read: entry: 013 data size                : 8176
libpff_index_node_read: entry: 013 reference count          : 1
libpff_index_node_read: entry: 013 data allocation table offset     : 0x1bf18400 (468812800)
libpff_index_node_read: entry: 014 index node identifier        : 0x0006c352 (443218)
libpff_index_node_read: entry: 014 file offset              : 0x1bef0000 (468647936)
libpff_index_node_read: entry: 014 data size                : 280
libpff_index_node_read: entry: 014 reference count          : 1
libpff_index_node_read: entry: 014 data allocation table offset     : 0x0e5fa690 (241149584)
libpff_index_node_read: entry: 015 index node identifier        : 0x0006c352 (443218)
libpff_index_node_read: entry: 015 file offset              : 0x1bef0000 (468647936)
libpff_index_node_read: entry: 015 data size                : 280
libpff_index_node_read: entry: 015 reference count          : 2
libpff_index_node_read: entry: 015 data allocation table offset     : 0x0e5fa690 (241149584)
libpff_index_node_read: entry: 016 index node identifier        : 0x0006c352 (443218)
libpff_index_node_read: entry: 016 file offset              : 0x1bef0000 (468647936)
libpff_index_node_read: entry: 016 data size                : 280
libpff_index_node_read: entry: 016 reference count          : 2
libpff_index_node_read: entry: 016 data allocation table offset     : 0x0e5fa690 (241149584)
libpff_index_node_read: entry: 017 index node identifier        : 0x0006c352 (443218)
libpff_index_node_read: entry: 017 file offset              : 0x1bef0000 (468647936)
libpff_index_node_read: entry: 017 data size                : 280
libpff_index_node_read: entry: 017 reference count          : 2
libpff_index_node_read: entry: 017 data allocation table offset     : 0x0e5fa690 (241149584)
libpff_index_node_read: entry: 018 index node identifier        : 0x00000000 (0)
libpff_index_node_read: entry: 018 file offset              : 0x00000000 (0)
libpff_index_node_read: entry: 018 data size                : 0
libpff_index_node_read: entry: 018 reference count          : 0
libpff_index_node_read: entry: 018 data allocation table offset     : 0x00000000 (0)
libpff_index_node_read: entry: 019 index node identifier        : 0x00000000 (0)
libpff_index_node_read: entry: 019 file offset              : 0x00000000 (0)
libpff_index_node_read: entry: 019 data size                : 0
libpff_index_node_read: entry: 019 reference count          : 0
libpff_index_node_read: entry: 019 data allocation table offset     : 0x00000000 (0)

libpff_index_read_node: index type mismatch (index: 0x81, node: 0x80).
libpff_index_read_sub_nodes: unable to read index node at offset: 3102077440.
libfdata_tree_read_sub_nodes: unable to read sub nodes at offset: 3102077440.
libfdata_tree_node_get_number_of_sub_nodes: unable to read sub nodes.
libpff_item_tree_create_node: unable to retrieve number of sub nodes from descriptor index tree node.
Name to ID map:
libpff_index_tree_get_leaf_node_by_identifier: requested identifier : 0x00000061 (97).
libfdata_tree_get_node_value: cache: 0x019148e0 hit (entry: 1)
libfdata_vector_get_element_index_at_offset: requested offset: 0xb8e5f200
libfdata_vector_get_element_index_at_offset: segment: 000   mapped range: 0x00000000 - 0x1faa08400 (size: 8499790848)
libfdata_vector_get_element_index_at_offset: segment: 000   file index: 000 offset: 0x00000000 - 0x1faa08400 (size: 8499790848)

libfdata_vector_get_element_value_by_index: cache: 0x018f4640 hit (13049 out of 16384)
libpff_index_read_node: index type mismatch (index: 0x81, node: 0x80).
libpff_index_read_sub_nodes: unable to read index node at offset: 3102077440.
libfdata_tree_read_sub_nodes: unable to read sub nodes at offset: 3102077440.
libfdata_tree_node_get_number_of_sub_nodes: unable to read sub nodes.
libpff_index_tree_node_get_leaf_node_by_identifier: unable to retrieve number of sub nodes from index tree node.
libpff_index_tree_get_leaf_node_by_identifier: unable to retrieve leaf node by identifier in root node.
libpff_index_tree_get_value_by_identifier: unable to retrieve leaf node by identifier in root node.
libpff_descriptors_index_get_index_value_by_identifier: unable to retrieve index value: 97.
libpff_name_to_id_map_read: unable to retrieve descriptor index value: 97.
Unable to export file.
libpff_file_get_root_folder: invalid file - missing root folder item tree node.
export_handle_export_items: unable to retrieve root folder.
export_handle_export_file: unable to export items.
Offsets read:
00000000 ( 0x00000000 ) - 00000564 ( 0x00000234 ) size: 564
3102077440 ( 0xb8e5f200 ) - 3102077952 ( 0xb8e5f400 ) size: 512
joachimmetz commented 9 years ago 
libpff_index_read_node: index type mismatch (index: 0x81, node: 0x80).

This error indicates the library encounters a part of the format it cannot handle. If time permits I'll have a look.

Any chance you can share the file?

eoyslebo commented 9 years ago

I had another look at it, and think I might have figured out the reason this is failing.

The OSTs I am having trouble with are from an HP laptop with a 750 GB spinning harddrive and an 8 GB SSD disk. The SSD seems to be configured as some sort of cache/RAID device through Intel Rapid Storage Technology.

Both X-Ways and FTK are happy exporting the file from the NTFS filesystem on the 750GB drive. These files can be opened with Kernel for OST to PST. X-Ways, FTK and pffexport all have trouble parsing them. They are likely corrupted by the RAID, though there is no sign of this when mounting the volume without enabling the cache.

When I boot Windows on the device and copy out the OSTs, I have no trouble opening these files with pffexport.