search

libyal / libpff

Library and tools to access the Personal Folder File (PFF) and the Offline Folder File (OFF) format
GNU Lesser General Public License v3.0
289 stars 74 forks source link

0 sized attachments from OST using version 20180714 #80

Closed lfcnassif closed 4 years ago

lfcnassif commented 5 years ago

Hi, After upgrading from version 20131028 to 20180714, some attachments (of various formats) are being extracted with 0 bytes. Unfortunatelly the OSTs contain private data and can not be shared. Verbose output could help? Thanks

lfcnassif commented 5 years ago

stderr: export_handle_export_attachments: unable to export attachment: 3. libpff_table_read_entry_value: unsupported value type: 0x00002102 with value size: 4. libpff_table_read_bc_record_entries: unable to read entry value: 1. libpff_table_read_bc_values: unable to read table record entries. libpff_table_read_values: unable to read table values. libpff_table_read: unable to read table values. libpff_item_values_read: unable to read table. libpff_item_values_get_record_entry_by_type: unable to read item values. libpff_internal_item_get_entry_value_32bit_integer: unable to retrieve record entry: 0x3705 0x0003. libpff_attachment_get_type: unable to retrieve attachment method. export_handle_export_attachment: unable to retrieve attachment type. export_handle_export_attachments: unable to export attachment: 1. libpff_table_read_entry_value: unsupported value type: 0x00002102 with value size: 4. libpff_table_read_bc_record_entries: unable to read entry value: 1. libpff_table_read_bc_values: unable to read table record entries. libpff_table_read_values: unable to read table values. libpff_table_read: unable to read table values. libpff_item_values_read: unable to read table. libpff_item_values_get_record_entry_by_type: unable to read item values. libpff_internal_item_get_entry_value_32bit_integer: unable to retrieve record entry: 0x3705 0x0003. libpff_attachment_get_type: unable to retrieve attachment method. export_handle_export_attachment: unable to retrieve attachment type. export_handle_export_item: skipped export of item: 1 out of: 1 of type: IPM.Microsoft.SniffData (0x00). libpff_message_get_html_body_size: missing value data. libpff_offsets_index_get_index_value_by_identifier: no recovered offsets index values for identifier: 1829568. libpff_io_handle_read_descriptor_data_list: unable to find offset index value identifier: 1829568. libpff_table_read: unable to read descriptor: 1682 data: 1829568 list. libpff_item_values_read: unable to read table. libpff_message_initialize_sub_item_recipients: unable to read recipients local descriptor identifier: 1682. libpff_message_determine_recipients: unable to create sub item recipients. libpff_message_get_recipients: unable to determine recipients. export_handle_export_recipients: unable to retrieve recipients. libpff_message_get_html_body_size: missing value data.

lfcnassif commented 5 years ago

For example, with a sample OST, 154 attachs of 12581 are exported with 0 bytes. A colleague of mine also found this behaviour with 20180714 version

joachimmetz commented 4 years ago

Unable to solve issue without debug information (https://github.com/libyal/libpff/wiki/Troubleshooting). Closing issue. If issue still persists with the latest HEAD feel free to reopen proving the necessary troubleshooting information.