search

thewhiteninja / ntfstool

Forensics tool for NTFS (parser, mft, bitlocker, deleted files)
MIT License
483 stars 97 forks source link

Long output filename (possibly) causing hang #21

Closed Bloggzy closed 2 years ago

Bloggzy commented 2 years ago

Firstly, great tool, really excellent, thank you!

This relates to the mft.dump function.

I've found (in some instances) that the process seems to hang, i.e. never completes. I'm not completely sure of the cause, but did note that when I specified a long filename as the output file, the hang occurred. I'm not completely set on this being the cause, as with other testing, I've been able to specify long output filenames with no issue. Please see screenshot below for an example:

NtfsTool-Long-Output-Filename-Hang

thewhiteninja commented 2 years ago

I can't reproduce the bug, I tried with short, long and very long filenames. It's a simple CreateFile, maybe the call succeeded and it hangs during the dump.

Do you know if the file "hostname_driveletter_mft.raw" was created?

Bloggzy commented 2 years ago

No worries, thanks for looking, I appreciate your time. I wasn't completely sure if it was connected to the long file name, so if I can reproduce the issue with anymore frequency I will let you know.

Bloggzy commented 2 years ago

Issue closed - unable to reproduce consistently - unknown cause.