search

teamdfir / sift

SIFT
MIT License
484 stars 67 forks source link

EWFmount Error #601

Open princedavinci opened 1 year ago

princedavinci commented 1 year ago

Hi All,

I am struggling to mount E01 images on the sift workstation using ewfmount. I get the below error: Capture I am so confused and not sure whats causing this issue. I using vmware player to run the environment. Any assistance will be highly appreciated.

Thanks.

mark-hallman commented 1 year ago

Your command line looks correct. Try renaming your E01 to remove the space. Also, confirm that /mnt/ewf_mount exists. It should, but check it anyway.

You can also verify the E01 with ewfinfo and ewfverify.

ewfinfo filename.E01 ewfverify filename.E01

princedavinci commented 1 year ago

I have tried with other E01s that dont have spaces and get the same error. I will perform the top two instructions and show output. Thanks for the speedy response.

princedavinci commented 1 year ago

Hi @mark-hallman please see screenshot below: Capture2

The said images mount perfectly on my WSL2 environment. Thanks

digitalsleuth commented 1 year ago

@princedavinci When running the ewf commands in WSL and in the VM, are you using the same image (E01) to test both environments? If so, can you try the following on the image from within the SIFT Workstation:

xxd 002-MEM-DTP.E01 | head
mmls 002-MEM-DTP.E01
ls -lah 002-MEM-DTP.E01

One difference could be how you're accessing the E01 from within the SIFT Workstation. If you have a Shared Folder mapped into the VM, then permissions to access the file might not be propagating through the Shared Folder. The same could be said if the file is accessed through a network share.

You could also try checking the MD5 of the file (not the E01 content hash, but simply the file) from within the SIFT Workstation and within the WSL environment to see if you have the same hash with both, and if you're able to access the E01 properly through both environments. This will help narrow down whether this is an ewftools issue or not.

Cheers

princedavinci commented 1 year ago

@digitalsleuth You make a lot of sense as I dragged files across onto the VM while on WSL I used the shared folder. Let try the above and will revert back.

Thanks

digitalsleuth commented 1 year ago

Hi @princedavinci , did you ever get this resolved?

princedavinci commented 1 year ago

Hi I eventually left it after realising the environment I was working on had too man security issues which in turn affected my access to the EO1 files. Sent from my iPhoneOn 28 Jul 2023, at 20:39, Digital Sleuth @.***> wrote: Hi @princedavinci , did you ever get this resolved?

—Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you were mentioned.Message ID: @.***>

joachimmetz commented 7 months ago

Try using a more recent version of ewfmount

princedavinci commented 7 months ago

Hi Joachim

will boot up the machine and try updating.

Thanks.

On Sat, Feb 10, 2024 at 11:52 AM Joachim Metz @.***> wrote:

Try using a more recent version of ewfmount

— Reply to this email directly, view it on GitHub https://github.com/teamdfir/sift/issues/601#issuecomment-1936957148, or unsubscribe https://github.com/notifications/unsubscribe-auth/ABKBEW3PRD2IEVL25F3P2MLYS47PBAVCNFSM6AAAAAAZPF2FR6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTSMZWHE2TOMJUHA . You are receiving this because you were mentioned.Message ID: @.***>

joachimmetz commented 7 months ago

will boot up the machine and try updating.

Does SIFT provide a more recent version?

ekristen commented 7 months ago

I'll be looking into this tomorrow to see where we source and what's available.

princedavinci commented 7 months ago

Sounds good, thanks!

On Mon, Feb 12, 2024 at 6:44 AM Erik Kristensen @.***> wrote:

I'll be looking into this tomorrow to see where we source and what's available.

— Reply to this email directly, view it on GitHub https://github.com/teamdfir/sift/issues/601#issuecomment-1938059980, or unsubscribe https://github.com/notifications/unsubscribe-auth/ABKBEW4J3HJ2VWONQM4QZKDYTGM4JAVCNFSM6AAAAAAZPF2FR6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTSMZYGA2TSOJYGA . You are receiving this because you were mentioned.Message ID: @.***>

ekristen commented 7 months ago

ewfmount comes from the GIFT.

22.04 - ewfmount 20140816 which is the latest from the PPA repository 20.04 - ewfmount 20140812 which is the latest from the PPA repository

joachimmetz commented 7 months ago

as you can see in the screenshot the reporter runs 20140807

joachimmetz commented 7 months ago

20.04 - ewfmount 20140812 which is the latest from the PPA repository

we don't support 20.04 any more, please upgrade to 22.04 and expect us to upgrade to 24.04 once available relatively quickly

ekristen commented 7 months ago

@joachimmetz understood you don't, but the packages are still available (please do not remove them, if you are I need a heads up so I can clone them)

22.04 is the new base image and we'll support 24.04 as soon as we can but you are 1 of hundreds we have to have support for to effectively make a new base image. Plus it takes time to swap out the major OS in classes.

@princedavinci you should be able to run apt-get upgrade or apt-get update && apt-get install libewf-tools to get the latest available ewfmount version.

joachimmetz commented 7 months ago

22.04 is the new base image and we'll support 24.04 as soon as we can but you are 1 of hundreds we have to have support for to effectively make a new base image.

Unclear what you mean with "supporting" me in this context? I don't need SIFT to support me, nor have I ever received support from SIFT or SANS for that matter.

This is why for Plaso we strongly recommend using Docker