Re: [sleuthkit-users] Errors with Autopsy

[DePriest, J. R. <jrd...@gm...>]

Forgot to mention: I have replaced both DATA_DIR instances with
DATADIR and I am doing the extraction again.  I may take a few hours
for me to get to a section that generated the errors, so I probably
won't post a pass / fail message until tomorrow.

On 3/15/06, DePriest, Jason R. <> wrote:
> It is in there with the underscore twice.
>
> A70067@ebizsrvb /sleuthkit/autopsy/lib
> $ grep -n 'DATA_DIR' Caseman.pm
> 3752:                . "$::DATA_DIR/"
> 3976:            . "$::DATA_DIR/"
> A70067@ebizsrvb /sleuthkit/autopsy/lib
> $ grep -n 'DATADIR' Caseman.pm
> 484:    print CASE_CONFIG "data         $::DATADIR\n";
> 1724:    unless (mkdir "$::host_dir" . "$::DATADIR", $::MKDIR_MASK) {
> 1727:        Print::print_err("Error making $::host_dir" . "$::DATADIR");
> 1732:        rmdir "$::host_dir" . "$::DATADIR";
> 1741:        rmdir "$::host_dir" . "$::DATADIR";
> 1751:        rmdir "$::host_dir" . "$::DATADIR";
> 3746:        my $fname_rel =3D "$::DATADIR/${base_name}-$ftype.asc";
> 3755:            $fname_rel =3D "$::DATADIR/${base_name}-$ftype-$i.asc";
> 3843:        my $fname_rel =3D "$::DATADIR/${base_name}-$ftype.uni";
> 3849:                . "$::DATADIR/"
> 3852:            $fname_rel =3D "$::DATADIR/${base_name}-$ftype-$i.uni";
> 3970:    my $fname_rel =3D "$::DATADIR/${base_name}-$ftype.unalloc";
> 3979:        $fname_rel =3D "$::DATADIR/${base_name}-$ftype-$i.unalloc"
>
> On 3/15/06, Paul Bakker <> wrote:
> > 3752                    . "$::DATA_DIR/"
> > ? In the other lines I see  $DATADIR withouth the _
> > Is this a typo from your side? Or is this actually present in the file.=
 (I don't have the files present now, so I can't check)
> >
> > But all other elements in that statement are already used in lines 3746=
 and 3747, so I think it might lay with that.
> >
> > Paul Bakker
> >
> >
> >
> > DePriest, Jason R. wrote:
> >
> > >I am trying to extract the strings from an image of an NTFS hard disk =
drive.
> > >
> > >Periodically, autopsy gives this error:
> > >Use of uninitialized value in concatenation (.) or string at
> > >/sleuthkit/autopsy/lib//Caseman.pm line 3751.
> > >
> > >It continues running, but spawns a new perl, dls, and srch_strings
> > >process.  Occasionally, it will start a new output file, too.  It will
> > >write data to both output files.
> > >
> > >Looking at that line in Caseman.pm, I am not sure what I could change =
to fix it.
> > >
> > >The section of code looks like this:
> > >3743       my $base_name =3D $Caseman::vol2sname{$vol};
> > >3744
> > >3745       if ($ascii =3D=3D 1) {
> > >3746           my $fname_rel =3D "$::DATADIR/${base_name}-$ftype.asc";
> > >3747           my $fname     =3D "$::host_dir" . "$fname_rel";
> > >3748
> > >3749           if (-e "$fname") {
> > >3750               my $i =3D 1;
> > >3751               $i++ while (-e "$::host_dir"
> > >3752                   . "$::DATA_DIR/"
> > >3753                   . "${base_name}-$ftype-$i.asc");
> > >3754
> > >3755               $fname_rel =3D "$::DATADIR/${base_name}-$ftype-$i.a=
sc";
> > >3756               $fname     =3D "$::host_dir" . "$fname_rel";
> > >3757           }
> > >3758
> > >3759           print
> > >3760   "Extracting ASCII strings from <tt>$Caseman::vol2sname{$vol}</t=
t><br>\n";
> > >3761
> > >3762           Print::log_host_inv(
> > >3763               "$Caseman::vol2sname{$vol}: Saving ASCII strings to
> > >$fname_rel");
> > >3764
> > >3765           local *OUT;
> > >
> > >-Jason
>