-
Notifications
You must be signed in to change notification settings - Fork 364
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Misc issues - RC testing #218
Comments
Bug fixed, some after care needed
Fix and clean up in: https://codereview.appspot.com/234700044/ More clean up needed reminder added to: #160 |
Open - WIP
So file entry is None here.
Ddetermine which path spec is causing this |
Fixed
|
Test again with dfvfs changes Still some issues with file handles not properly closed. This is taken from one of the Mac test images:
These errors (both the Mac OS X ones) appear quite frequently in all Mac OS X parsing, need to go over the Mac OS X parsers and make sure the explicitly close file handles. All Mac enabled parsers still seem to have an explicit close operation (most inherit from |
Test again with timelib changes Another random error in logs (408 challenge image):
Unknown origin, need to track that one down. Seeing few of these:
|
|
Fixed Using --partition 2 gets me the traceback:
Changing this to a decimal value now reveals:
|
Fixed Status view = window on Windows has minor issues with extra characters added: |
Fixed If you run the tool against a disk image that has VSS stores on them and you supply the --no-vss parameter nothing will get parsed:
the If there is a VSS scan node the TSK current volume scan node is not moved to the same level as the VSS one is in the case where VSS is not processed. |
Open Running against nfury image I see a lot of:
|
Test again with dfvfs fixes One of the Mac test images:
|
Won't fix for now This message is repeated quite frequently, sometimes as: Addition: So this file contains gzip compressed data but not complete. The issue here is greedy parsing approach and hard to detect certain file types. A fix could be to excluded certain files from parsing. |
These appear to be TSK HFS bugs
Addition: If you do a manual icat of the file TSK throws the same error, so this seems to be a bug in TSK HFS support Already filed: sleuthkit/sleuthkit#401
This zlib error comes up quite a few times in the logs Addition: This looks like a TSK HFS bug, filed sleuthkit/sleuthkit#471 |
Fixed
|
Work in progress
The invalid offset function is when a seek operation is attempted with a <0 offset value (after calculations based on the whence value)
Something is doing a negative seek set, seems to be openxml
Looking at the code of that parser my best guess is that zipfile might be the culprit. |
Plaso 1.3.0 RC2 20150701 |
Hmm, yes, that was the intention. I'll look into while the error isn't being raised. -Daniel On Thu, 2 Jul 2015 at 17:22 rodgermoore [email protected] wrote:
|
Moved remaining issues to separate issue trackers, closing this one. |
Was this " Add parser information to the "Unable to process path spec" bug if possible to make debugging easier" fixed? I am getting:
|
@xhlika why are you commenting on a closed issue that is not related to your issue? It also looks like you're using an old version of Plaso, so what version are you using? |
@joachimmetz sorry about that. This GitHub issue was the only google search result that was linked to my issue. I think the version I am is relatively new version (seems 2019): plaso - log2timeline version 20190331. Any idea where the issue lies, I am simply running plaso with this command: log2timeline -z UTC --status_view window --parsers "win7,-filestat" C:\Users............\plaso_full.dump C:\Users...........\x.E01 |
https://prnt.sc/1vyeksy it appears that after the "Main" worker, the next worker failed. The File column is saying "TSK:/". Update: I just tried without VSS and it is working now. I really need the VSS to be there as well, any hint how to bypass the issue. There is only 1 vss (vss1) and when i am asked from log2timeline "please specify vss to consider" I choose "......... :1". Any hint what I am doing wrong? |
What does pinfo tell you more about the error? (as the message suggests) See here for tips on troubleshooting https://plaso.readthedocs.io/en/latest/sources/Troubleshooting.html
This version (from March 2019) is older than 6 months so we consider it out of date and strongly recommend to update to a more recent version, including dependencies. Note that issues get addressed continously |
The first comment above was the output from pinfo (see above). The issue seems to be VSS. When I execute log2timeline and ignore the VSS, the parsing works (still ongoing). If you have no idea why VSS is causing this, then I can maybe try the update but I wonder if it will help. The issue should have been fixed in 2015 (at least based on this issue). |
what issue should be fixed in 2015? "Unable to process path spec" is not a bug its a warning that things could not be processed, there are many different reasons for this.
I have insufficient information. You'll need to be more specific and provide the information outlined in https://plaso.readthedocs.io/en/latest/sources/Troubleshooting.html |
The "bug" that this issue is referring to is that parser information was missing from the debug logs, but in your case an issue seems to happen outside of a parser. The 2 things are not related. |
This is a place holder issue for issues uncovered while pre RC testing see below for detailed information.
Completed
preg broken: Preg tool GetHivesAndCollectors method is broken #236IndexError -> list index out of range in ASL parserfirefox_old_cache fix missing explicit close and code clean upAdd filename to error:Unsupported Custom Destination file - invalid entry header.
- https://codereview.appspot.com/240480043/Improve liblnk - bug fixcheck if Python logger appends or truncates existing log file by default - also what should be the desired behavior IMO truncate - https://codereview.appspot.com/243200043/flaky rawpy test flaky test: rawpy output #232fix non-explicit close winreg - https://codereview.appspot.com/245980043/error logged in timelib - https://codereview.appspot.com/245190043/add support for '--parsers list' Clean up: frontend #120expose SIGSEGV handler for debugging purposes - http://codereview.appspot.com/240570043Fix the partition selectionissue in pinfo pinfo is missing parser counter #237make status view window work for Windows - https://codereview.appspot.com/242200043/Added missing license files - http://codereview.appspot.com/244270043Display name add VSS support - needed for trouble shooting - https://codereview.appspot.com/241430043/changes in ASL parser for better exception handling: http://codereview.appspot.com/248800043Add parser information to the "Unable to process path spec" bug if possible to make debugging easierSIGSEGV in libvshadow - memory corruption was (very likely) caused somewhere elseImprove libfwsi - at least sufficient for nowRPC needs a bit more time to establish channelsfix non-explicit closes - https://codereview.appspot.com/246090043/Fix issue with source scanner issue with source scanner #229Add BDE support add multi volume support #109viper analysis plugin - https://codereview.appspot.com/246500043/chrome_cache did not explicitly close file-object for file - https://codereview.appspot.com/250130043/Improve BDE support add multi volume support #109Won't fix (Unlikely to be fixed before release)
The text was updated successfully, but these errors were encountered: