Re: [sleuthkit-users] Errors with Autopsy

[Brian C. <ca...@sl...>]

Yea, those should be DATADIR.  Those are the only two instances of =20
that.  I just fixed that.

thanks,
brian


On Mar 15, 2006, at 6:08 PM, DePriest, Jason R. wrote:

> Forgot to mention: I have replaced both DATA_DIR instances with
> DATADIR and I am doing the extraction again.  I may take a few hours
> for me to get to a section that generated the errors, so I probably
> won't post a pass / fail message until tomorrow.
>
> On 3/15/06, DePriest, Jason R. <> wrote:
>> It is in there with the underscore twice.
>>
>> A70067@ebizsrvb /sleuthkit/autopsy/lib
>> $ grep -n 'DATA_DIR' Caseman.pm
>> 3752:                . "$::DATA_DIR/"
>> 3976:            . "$::DATA_DIR/"
>> A70067@ebizsrvb /sleuthkit/autopsy/lib
>> $ grep -n 'DATADIR' Caseman.pm
>> 484:    print CASE_CONFIG "data         $::DATADIR\n";
>> 1724:    unless (mkdir "$::host_dir" . "$::DATADIR", $::MKDIR_MASK) {
>> 1727:        Print::print_err("Error making $::host_dir" . =20
>> "$::DATADIR");
>> 1732:        rmdir "$::host_dir" . "$::DATADIR";
>> 1741:        rmdir "$::host_dir" . "$::DATADIR";
>> 1751:        rmdir "$::host_dir" . "$::DATADIR";
>> 3746:        my $fname_rel =3D "$::DATADIR/${base_name}-$ftype.asc";
>> 3755:            $fname_rel =3D "$::DATADIR/${base_name}-$ftype-=20
>> $i.asc";
>> 3843:        my $fname_rel =3D "$::DATADIR/${base_name}-$ftype.uni";
>> 3849:                . "$::DATADIR/"
>> 3852:            $fname_rel =3D "$::DATADIR/${base_name}-$ftype-=20
>> $i.uni";
>> 3970:    my $fname_rel =3D "$::DATADIR/${base_name}-$ftype.unalloc";
>> 3979:        $fname_rel =3D =
"$::DATADIR/${base_name}-$ftype-$i.unalloc"
>>
>> On 3/15/06, Paul Bakker <> wrote:
>>> 3752                    . "$::DATA_DIR/"
>>> ? In the other lines I see  $DATADIR withouth the _
>>> Is this a typo from your side? Or is this actually present in the =20=

>>> file. (I don't have the files present now, so I can't check)
>>>
>>> But all other elements in that statement are already used in =20
>>> lines 3746 and 3747, so I think it might lay with that.
>>>
>>> Paul Bakker
>>>
>>>
>>>
>>> DePriest, Jason R. wrote:
>>>
>>>> I am trying to extract the strings from an image of an NTFS hard =20=

>>>> disk drive.
>>>>
>>>> Periodically, autopsy gives this error:
>>>> Use of uninitialized value in concatenation (.) or string at
>>>> /sleuthkit/autopsy/lib//Caseman.pm line 3751.
>>>>
>>>> It continues running, but spawns a new perl, dls, and srch_strings
>>>> process.  Occasionally, it will start a new output file, too.  =20
>>>> It will
>>>> write data to both output files.
>>>>
>>>> Looking at that line in Caseman.pm, I am not sure what I could =20
>>>> change to fix it.
>>>>
>>>> The section of code looks like this:
>>>> 3743       my $base_name =3D $Caseman::vol2sname{$vol};
>>>> 3744
>>>> 3745       if ($ascii =3D=3D 1) {
>>>> 3746           my $fname_rel =3D "$::DATADIR/${base_name}-=20
>>>> $ftype.asc";
>>>> 3747           my $fname     =3D "$::host_dir" . "$fname_rel";
>>>> 3748
>>>> 3749           if (-e "$fname") {
>>>> 3750               my $i =3D 1;
>>>> 3751               $i++ while (-e "$::host_dir"
>>>> 3752                   . "$::DATA_DIR/"
>>>> 3753                   . "${base_name}-$ftype-$i.asc");
>>>> 3754
>>>> 3755               $fname_rel =3D "$::DATADIR/${base_name}-$ftype-=20=

>>>> $i.asc";
>>>> 3756               $fname     =3D "$::host_dir" . "$fname_rel";
>>>> 3757           }
>>>> 3758
>>>> 3759           print
>>>> 3760   "Extracting ASCII strings from <tt>$Caseman::vol2sname=20
>>>> {$vol}</tt><br>\n";
>>>> 3761
>>>> 3762           Print::log_host_inv(
>>>> 3763               "$Caseman::vol2sname{$vol}: Saving ASCII =20
>>>> strings to
>>>> $fname_rel");
>>>> 3764
>>>> 3765           local *OUT;
>>>>
>>>> -Jason
>>
>
>
> -------------------------------------------------------
> This SF.Net email is sponsored by xPML, a groundbreaking scripting =20
> language
> that extends applications into web and mobile media. Attend the =20
> live webcast
> and join the prime developer group breaking into this new coding =20
> territory!
> http://sel.as-us.falkag.net/sel?cmd=3Dlnk&kid=110944&bid$1720&dat=121642=

> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>
>