Closed DeveloperNamedMax closed 11 months ago
I can't see any error related to VMDK processing above. All messages seem related to the graph module that uses Neo4j library.
If you are running processing inside a virtual machine using "shared folders" as the case output, try to avoid it and redirect the case output to a virtual disk, shared folders can cause issues with some modules, since they use network shares and those shares aren't reliable for concurrent access.
About disabling embedded disk processing, that can be done into IPEDConfig.txt -> processEmbeddedDisks = false
, but as I said, errors above don't seem related to it.
Are you able to provide a sample and a step by step to reproduce errors above?
I am running 4.1.4 version of IPED inside VMWare virtual machine. Case output and case images to process are on HDD which i share using VMWare "Shared Folders" feature. The settings to run are default of profile "forensics".Inside my image is a VMDK virtual machine (embedded virtual disk).
Also i would like to mention that i did a batch script to run IPED each time it fails/errors to check whether it was one time thing, but after running 10+ times each time i get the same error. But i think you are right that it might be Shared Folders feature and it isn't stable.
Therefore I am going to try and use Virtual Disk option instead of Shared folders like you recommended. Since processing takes a while i will give you an update once it finishes or if the problem arises again.
Thanks for reply!
@lfcnassif Finished processing without any errors! Thanks for the advice, the problem was the "Shared Folders" function in VMWare which as you said wasn't stable enough.
I fixed it by adding "Hard Disk" linking physical disk instead in VMWare.
Thank you for help !
You're welcome, thanks for the feedback.
PS: I think you can use shared folders to share the images to be processed/read, but not as output folder or temp, where a lot of data is written to.
Version: 4.1.4
I am processing image which has embedded VMDK file inside with size ~50GB. IPED keeps erroring each time processing it, it might be corrupted, is there any way to skip VMDK files, does commenting ISO disks inside conf/CategoriesToExpand.txt ignores it?
The error i keep getting (been running ~20 times and everytime it gets stuck on the same error on the VMDK image):