Re: [sleuthkit-users] FLS on Windows Errors

[Theodore P. <te...@gm...>]

I think I see what you're doing wrong.

I created a bat file and put these lines into it:

set TOOLDIR=bb
fls -m C: \\.\C: > "%TOOLDIR%-PC files.txt"

When I execute the bat file, it works and prints the following to console:

C:\temp2>fl.bat

C:\temp2>set TOOLDIR=bb

C:\temp2>fls -m C: \\.\C:  1>"bb-PC files.txt"

Now change the bat file to the following:

set TOOLDIR="bb"
fls -m C: \\.\C: > "%TOOLDIR%-PC files.txt"

When I execute the bat file now, it works and prints the following to console:

C:\temp2>fl.bat

C:\temp2>set TOOLDIR="bb"

C:\temp2>fls -m C: \\.\C:  1>""bb"-PC files.txt"

Now change the bat file to the following:

set TOOLDIR="b b b"
fls -m C: \\.\C: > "%TOOLDIR%-PC files.txt"

When I execute the bat file now, it fails and gives the split_open
error with the following console output:

C:\temp2>fl.bat

C:\temp2>set TOOLDIR="b b b"

C:\temp2>fls -m C: \\.\C:  b b"-PC files.txt" 1>""b
Error stat(ing) image file (split_open - \\.\C: - No such file or directory)

Notice how the quotation marks expand from the variable and then
causes the command line string to terminate in unintended ways. Also,
if you have an extra space character at the end of the variable or at
the end of the fls command line, you will also get similar unexpected
results.

So moral of the story, be very careful with whitespace and quotation
marks when writing batch scripts.

On Wed, Apr 21, 2010 at 4:54 PM, Joseph R. Murray <jr....@gm...> wrote:
> System: Windows Vista x64
> Package: Latest Windows binaries (TSK 3.1.1) via the .zip file
> Unzipped to the run location along with the DLLs etc.
>
> When running FLS through a batch file, I get this error:
> Error stat(ing) image file (split_open -
>
> Here is my command to call FLS:
> C:\>"%TOOLDIR%\fls" –m C: –r \\.\C: >
> "%TOOLDIR%\%LOGDIR%\%COMPUTERNAME%-files.txt"
>
> To simplify, picture this:
> C:\>"C:\Temp\Tools\fls" -m C: -r \\.\C: >
> "C:\Temp\Tools\..\Logs\PC-files.txt"
>
> Unfortunately, this usually happens when trying to use this within a batch
> file, while usually working when I use it via command-line directly.  It
> also seems to help if I navigate to the C:\ root in DOS before I execute the
> command, although this is nowhere near full-proof as I cannot get it to
> reliably execute in either scenario.
>
> I have tried recompiling this with Visual Studio 2010, but have come across
> great difficulty with libews and zlib.  Apparently even VS2008 projects need
> to be converted to work, and assembly files are not supported.  Even so,
> given that similar issues have considered to be bugs (current, as far as I
> know), I am not sure recompiling will even fix it
> (http://old.nabble.com/problems-running-sleuthkit-on-Windows-Server-2003-x64-td27189560.html).
>
> This is also a problem across several PCs in my batch file, not just my
> own.  This has been tested on 32-bit Windows systems as well with the same
> result.
>
>
> Regards,
> J.R. Murray
>
>
> ------------------------------------------------------------------------------
>
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>
>