[sleuthkit-users] tsk_loaddb failing with -h

[Ketil F. <ke...@fr...>]

Hi,

I'm running tsk_loaddb from tsk 4.1.3 on Ubuntu 14.04. Ubuntu is
bundled with an older version, so I downloaded the source tarball and
built it. First I built libewf-20140608 like this:

./configure --enable-python --enable-verbose-output
--enable-debug-output --prefix=$HOME/tsk
make
make install

and then TSK like this:

./configure --prefix=$HOME/tskk --with-libewf=$HOME/tsk --disable-java
make
make install

Now, tsk_loaddb works fine without the -h switch, but when I try to
enable hashing I get lots of errors, both of these errors are repeated
lots of times:

Error:
Error: Database Error (TskDbSqlite::addFile: Error adding data to
tsk_files table: unrecognized token "dbe0f49aabec8001c62ef508e19e5584"
)
Error:
Error: Database Error (TskDbSqlite::addFile: Error adding data to
tsk_files table: near "f3133e4c78b43def98234ffebc556b90": syntax error
)

My commands were:

tsk_loaddb -i ewf -d nohash.db image.E01
or
tsk_loaddb -i ewf -h -d hash.db image.E01

I have sqlite3 v3.8.2. Now that I double checked I didn't have
libsqlite3-dev installed, but everything built fine and tsk_loaddb
works great without -h, so I guess that's not the issue. Had a brief
look into tsk/auto/db_sqlite.cpp, but didn't spot the issue.

Is this a bug, or did I do something wrong?

-Ketil