search

rowingdude / analyzeMFT

MIT License
423 stars 117 forks source link

index out of range #61

Open thedeepaxe opened 1 month ago

thedeepaxe commented 1 month ago

Hello,

Using the following: ./analyzeMFT.py -f ../Downloads/C/\$MFT

I am getting this error:

Traceback (most recent call last): File "/home/kari/analyzeMFT/./analyzeMFT.py", line 21, in session.process_mft_file() File "/home/kari/analyzeMFT/analyzemft/mftsession.py", line 189, in process_mft_file self.build_filepaths() File "/home/kari/analyzeMFT/analyzemft/mftsession.py", line 281, in build_filepaths record = mft.parse_record(raw_record, self.options) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/home/kari/analyzeMFT/analyzemft/mft.py", line 68, in parse_record atr_record = decode_atr_header(raw_record[read_ptr:]) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/home/kari/analyzeMFT/analyzemft/mft.py", line 621, in decode_atr_header (d['ndataruns'], d['dataruns'], d['drunerror']) = unpack_dataruns(s[64:]) ^^^^^^^^^^^^^^^^^^^^^^^ File "/home/kari/analyzeMFT/analyzemft/mft.py", line 660, in unpack_dataruns bit_len = bitparse.parse_little_endian_signed(datarun_str[pos:pos + lengths.b.lenlen]) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/home/kari/analyzeMFT/analyzemft/bitparse.py", line 36, in parse_little_endian_signed value |= buf[i] << (i * 8)


IndexError: index out of range
badr-boukari commented 1 month ago

The same problem here using the following: $python2 ../Tools/analyzeMFT/analyzeMFT.py -o fs-mft-29-05-2024.csv -f mft-after --bodyfull

python2 -V ===> Python 2.7.18

Or even: $python3 ../Tools/analyzeMFT/analyzeMFT.py -o fs-mft-29-05-2024.csv -f mft-after --bodyfull

python3 -V ===> Python 3.8.10

mwalkowski commented 4 days ago

I have prepared a PR fixing this bug https://github.com/rowingdude/analyzeMFT/pull/63