Replies: 2 comments 4 replies
-
|
This is often caused because Sleuthkit wasn't able to recognize or decode the file system of some partition. A common workaround is creating an AD1 image from the E01 using FTKImager and then processing it, IPED is able to ingest AD1 images by itself, bypassing Sleuthkit. But the "unrecognized file system" error is not clear above, maybe IPED is erroneously hiding some important Sleuthkit warning messages. Please run Sleuthkit-4.12.0 tsk_loaddb tool (https://github.com/sleuthkit/sleuthkit/releases/tag/sleuthkit-4.12.0) on your E01 image and post the console output here, so we can compare. |
Beta Was this translation helpful? Give feedback.
-
|
I created an ad1 from the root folder of the mounted image, in fact the iped ends without any non-standard notes (remembering that even pointing out the errors above, iped finished the e01 indexing. I'm just trying to understand the error). I ran the following command on the e01 file (not sure if that's what you said): I copied just an output part because it is huge. But it generates the database file of the image: TskAutoDb::startAddImage: Starting add image process |
Beta Was this translation helpful? Give feedback.
-
Actually I meant to create the AD1 from inside FTKImager (right click on the root folder of each partition), this would include deleted files and unallocated. Mounting the E01 could miss those artifacts depending on the mounting options.
If some partition wasn't recognized, it was processed like an unallocated space, without decoding the file system tree.
That output is too verbose to check what I would like to, could you run without the |
Beta Was this translation helpful? Give feedback.
-
|
It creates the database and print the message: "Database stored at: ...." with nothing more. |
Beta Was this translation helpful? Give feedback.
-
|
So unfortunately I would need to change IPED code to print all TSK java output in a debug branch... Would you be able to download a snapshot version and run it again on the image? |
Beta Was this translation helpful? Give feedback.
-
|
yes |
Beta Was this translation helpful? Give feedback.
-
I came across some iped processing that point to an error, but finalize.
I had already seen something similar, when it couldn't identify the file system of a partition for example.
In this case below I didn't see any indication of why it couldn't handle some parts of the image.
would it be related to volume2? "2023-05-09 09:09:28 [WARN] [task.index.IndexTask] Null Text reader, creating a new one for /image.E01/vol_vol2"
INFO: sqlite-jdbc version 3.34.0 loaded in native mode
2023-05-09 09:09:26 [INFO] [engine.sleuthkit.SleuthkitClient] Starting SleuthkitServer 0 started.
2023-05-09 09:09:26 [INFO] [engine.datasource.SleuthkitReader] Decoding image E:\image.E01
2023-05-09 09:09:28 [WARN] [task.index.IndexTask] Null Text reader, creating a new one for /image.E01
2023-05-09 09:09:28 [WARN] [task.index.IndexTask] Null Text reader, creating a new one for /image.E01/vol_vol2
2023-05-09 09:09:28 [WARN] [task.index.IndexTask] Null Text reader, creating a new one for /image.E01/vol_vol2
org.sleuthkit.datamodel.TskDataException: Errors occurred while ingesting image
1.
2.
3.
2023-05-09 09:09:32 [ERROR] [engine.datasource.SleuthkitReader] 1. Image: E:\image.E01
2023-05-09 09:09:32 [ERROR] [engine.datasource.SleuthkitReader] 2. Image: E:\image.E01
2023-05-09 09:09:32 [ERROR] [engine.datasource.SleuthkitReader] 3. Image: E:\image.E01
2023-05-09 09:09:32 [INFO] [engine.datasource.SleuthkitReader] Image decoded: E:\image.E01
2023-05-08 19:05:43 [ERROR] [engine.datasource.SleuthkitReader] 1. Image: image.E01
2023-05-08 19:05:43 [ERROR] [engine.datasource.SleuthkitReader] 2. Image: image.E01
2023-05-08 19:05:43 [ERROR] [engine.datasource.SleuthkitReader] 3. Image: image.E01
IPED finished
Beta Was this translation helpful? Give feedback.
All reactions