Re: [sleuthkit-users] seluthkit/libewf problems

[Donald M. <don...@ny...>]

Thanks, setting the limit higher worked for both tsk and ewf.

Don

On Tue, Jun 3, 2014 at 1:28 PM, Kalin KOZHUHAROV <me....@gm...> wrote:

> Hello,
>
> On Wed, Jun 4, 2014 at 1:50 AM, Donald Mennerich <don...@ny...>
> wrote:
> > I recently acquired a large (2 TB) disk image using FTK Imager. The
> image of
> > an HFS+ drive is partitioned into 1.5gb segments and I had the
> compression
> > set to 0 while it was imaging. There are over 1,200 segments that make up
> > the image.
> >
> > The disk image loads into FTK fine and seems to be working great. I
> cannot
> > get any of the the Sleuthkit or EwfTools bins to work with the image
> though.
> > I've created images of several images of smaller disk drives (60gb,
> 100gb,
> > 160gb) and they all work fin with the bins. I'd like to know if there is
> > something fundamentally wrong with the 2TB disk image. I'm running the
> tools
> > on a Fedora 20 machine with both libraries having been built from the
> > sources.
> >
> What is the output of `ulimit -a |grep files` with the account you used?
> (Standard is 1024 max open files)
>
> As shown in the error:
>
> > with error: Too many open files
>
> > I'd be really curious to know what those more knowledgeable on both
> libewf
> > and tsk would make of these outputs, hopefully I'm just doing something
> > completely stupid.
> >
> Not completely stupid, just read the error messages :-)
>
> If you try as root (which I don't recommend for many reasons), there
> is usually no limit.
> Better set your ulimit for the user before you run the command:
>
> $ ulimit -n 2000
> $ ulimit -n
> 2000
> $ ewfinfo FA_MSS_343_1.E01
>
> You can permanently increase ulimit, but check how to do it on Fedora
> (or just stick it in .bashrc).
>
> Cheers,
> Kalin.
>