Re: [sleuthkit-users] Errors with Autopsy

[DePriest, J. R. <jrd...@gm...>]

It is in there with the underscore twice.

A70067@ebizsrvb /sleuthkit/autopsy/lib
$ grep -n 'DATA_DIR' Caseman.pm
3752:                . "$::DATA_DIR/"
3976:            . "$::DATA_DIR/"
A70067@ebizsrvb /sleuthkit/autopsy/lib
$ grep -n 'DATADIR' Caseman.pm
484:    print CASE_CONFIG "data         $::DATADIR\n";
1724:    unless (mkdir "$::host_dir" . "$::DATADIR", $::MKDIR_MASK) {
1727:        Print::print_err("Error making $::host_dir" . "$::DATADIR");
1732:        rmdir "$::host_dir" . "$::DATADIR";
1741:        rmdir "$::host_dir" . "$::DATADIR";
1751:        rmdir "$::host_dir" . "$::DATADIR";
3746:        my $fname_rel =3D "$::DATADIR/${base_name}-$ftype.asc";
3755:            $fname_rel =3D "$::DATADIR/${base_name}-$ftype-$i.asc";
3843:        my $fname_rel =3D "$::DATADIR/${base_name}-$ftype.uni";
3849:                . "$::DATADIR/"
3852:            $fname_rel =3D "$::DATADIR/${base_name}-$ftype-$i.uni";
3970:    my $fname_rel =3D "$::DATADIR/${base_name}-$ftype.unalloc";
3979:        $fname_rel =3D "$::DATADIR/${base_name}-$ftype-$i.unalloc"

On 3/15/06, Paul Bakker <> wrote:
> 3752                    . "$::DATA_DIR/"
> ? In the other lines I see  $DATADIR withouth the _
> Is this a typo from your side? Or is this actually present in the file. (=
I don't have the files present now, so I can't check)
>
> But all other elements in that statement are already used in lines 3746 a=
nd 3747, so I think it might lay with that.
>
> Paul Bakker
>
>
>
> DePriest, Jason R. wrote:
>
> >I am trying to extract the strings from an image of an NTFS hard disk dr=
ive.
> >
> >Periodically, autopsy gives this error:
> >Use of uninitialized value in concatenation (.) or string at
> >/sleuthkit/autopsy/lib//Caseman.pm line 3751.
> >
> >It continues running, but spawns a new perl, dls, and srch_strings
> >process.  Occasionally, it will start a new output file, too.  It will
> >write data to both output files.
> >
> >Looking at that line in Caseman.pm, I am not sure what I could change to=
 fix it.
> >
> >The section of code looks like this:
> >3743       my $base_name =3D $Caseman::vol2sname{$vol};
> >3744
> >3745       if ($ascii =3D=3D 1) {
> >3746           my $fname_rel =3D "$::DATADIR/${base_name}-$ftype.asc";
> >3747           my $fname     =3D "$::host_dir" . "$fname_rel";
> >3748
> >3749           if (-e "$fname") {
> >3750               my $i =3D 1;
> >3751               $i++ while (-e "$::host_dir"
> >3752                   . "$::DATA_DIR/"
> >3753                   . "${base_name}-$ftype-$i.asc");
> >3754
> >3755               $fname_rel =3D "$::DATADIR/${base_name}-$ftype-$i.asc=
";
> >3756               $fname     =3D "$::host_dir" . "$fname_rel";
> >3757           }
> >3758
> >3759           print
> >3760   "Extracting ASCII strings from <tt>$Caseman::vol2sname{$vol}</tt>=
<br>\n";
> >3761
> >3762           Print::log_host_inv(
> >3763               "$Caseman::vol2sname{$vol}: Saving ASCII strings to
> >$fname_rel");
> >3764
> >3765           local *OUT;
> >
> >-Jason