Thread: [sleuthkit-users] tsk_loaddb failing with -h
Brought to you by:
carrier
From: Ketil F. <ke...@fr...> - 2014-09-30 13:31:19
|
Hi, I'm running tsk_loaddb from tsk 4.1.3 on Ubuntu 14.04. Ubuntu is bundled with an older version, so I downloaded the source tarball and built it. First I built libewf-20140608 like this: ./configure --enable-python --enable-verbose-output --enable-debug-output --prefix=$HOME/tsk make make install and then TSK like this: ./configure --prefix=$HOME/tskk --with-libewf=$HOME/tsk --disable-java make make install Now, tsk_loaddb works fine without the -h switch, but when I try to enable hashing I get lots of errors, both of these errors are repeated lots of times: Error: Error: Database Error (TskDbSqlite::addFile: Error adding data to tsk_files table: unrecognized token "dbe0f49aabec8001c62ef508e19e5584" ) Error: Error: Database Error (TskDbSqlite::addFile: Error adding data to tsk_files table: near "f3133e4c78b43def98234ffebc556b90": syntax error ) My commands were: tsk_loaddb -i ewf -d nohash.db image.E01 or tsk_loaddb -i ewf -h -d hash.db image.E01 I have sqlite3 v3.8.2. Now that I double checked I didn't have libsqlite3-dev installed, but everything built fine and tsk_loaddb works great without -h, so I guess that's not the issue. Had a brief look into tsk/auto/db_sqlite.cpp, but didn't spot the issue. Is this a bug, or did I do something wrong? -Ketil |
From: Brian C. <ca...@sl...> - 2014-09-30 15:31:20
|
HI Ketil, I think I fixed that, but haven't released it. Can you download the latest source and try that one: https://github.com/sleuthkit/sleuthkit/archive/develop.zip On Sep 30, 2014, at 9:25 AM, Ketil Froyn <ke...@fr...> wrote: > Hi, > > I'm running tsk_loaddb from tsk 4.1.3 on Ubuntu 14.04. Ubuntu is > bundled with an older version, so I downloaded the source tarball and > built it. First I built libewf-20140608 like this: > > ./configure --enable-python --enable-verbose-output > --enable-debug-output --prefix=$HOME/tsk > make > make install > > and then TSK like this: > > ./configure --prefix=$HOME/tskk --with-libewf=$HOME/tsk --disable-java > make > make install > > Now, tsk_loaddb works fine without the -h switch, but when I try to > enable hashing I get lots of errors, both of these errors are repeated > lots of times: > > Error: > Error: Database Error (TskDbSqlite::addFile: Error adding data to > tsk_files table: unrecognized token "dbe0f49aabec8001c62ef508e19e5584" > ) > Error: > Error: Database Error (TskDbSqlite::addFile: Error adding data to > tsk_files table: near "f3133e4c78b43def98234ffebc556b90": syntax error > ) > > My commands were: > > tsk_loaddb -i ewf -d nohash.db image.E01 > or > tsk_loaddb -i ewf -h -d hash.db image.E01 > > I have sqlite3 v3.8.2. Now that I double checked I didn't have > libsqlite3-dev installed, but everything built fine and tsk_loaddb > works great without -h, so I guess that's not the issue. Had a brief > look into tsk/auto/db_sqlite.cpp, but didn't spot the issue. > > Is this a bug, or did I do something wrong? > > -Ketil > > ------------------------------------------------------------------------------ > Meet PCI DSS 3.0 Compliance Requirements with EventLog Analyzer > Achieve PCI DSS 3.0 Compliant Status with Out-of-the-box PCI DSS Reports > Are you Audit-Ready for PCI DSS 3.0 Compliance? Download White paper > Comply to PCI DSS 3.0 Requirement 10 and 11.5 with EventLog Analyzer > http://pubads.g.doubleclick.net/gampad/clk?id=154622311&iu=/4140/ostg.clktrk > _______________________________________________ > sleuthkit-users mailing list > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users > http://www.sleuthkit.org |
From: Ketil F. <ke...@fr...> - 2014-10-01 10:16:22
|
Develop worked better! Thanks. Thanks, Ketil On 30 September 2014 17:31, Brian Carrier <ca...@sl...> wrote: > HI Ketil, > > I think I fixed that, but haven't released it. > > Can you download the latest source and try that one: > > https://github.com/sleuthkit/sleuthkit/archive/develop.zip > > > On Sep 30, 2014, at 9:25 AM, Ketil Froyn <ke...@fr...> wrote: > >> Hi, >> >> I'm running tsk_loaddb from tsk 4.1.3 on Ubuntu 14.04. Ubuntu is >> bundled with an older version, so I downloaded the source tarball and >> built it. First I built libewf-20140608 like this: >> >> ./configure --enable-python --enable-verbose-output >> --enable-debug-output --prefix=$HOME/tsk >> make >> make install >> >> and then TSK like this: >> >> ./configure --prefix=$HOME/tskk --with-libewf=$HOME/tsk --disable-java >> make >> make install >> >> Now, tsk_loaddb works fine without the -h switch, but when I try to >> enable hashing I get lots of errors, both of these errors are repeated >> lots of times: >> >> Error: >> Error: Database Error (TskDbSqlite::addFile: Error adding data to >> tsk_files table: unrecognized token "dbe0f49aabec8001c62ef508e19e5584" >> ) >> Error: >> Error: Database Error (TskDbSqlite::addFile: Error adding data to >> tsk_files table: near "f3133e4c78b43def98234ffebc556b90": syntax error >> ) >> >> My commands were: >> >> tsk_loaddb -i ewf -d nohash.db image.E01 >> or >> tsk_loaddb -i ewf -h -d hash.db image.E01 >> >> I have sqlite3 v3.8.2. Now that I double checked I didn't have >> libsqlite3-dev installed, but everything built fine and tsk_loaddb >> works great without -h, so I guess that's not the issue. Had a brief >> look into tsk/auto/db_sqlite.cpp, but didn't spot the issue. >> >> Is this a bug, or did I do something wrong? >> >> -Ketil >> >> ------------------------------------------------------------------------------ >> Meet PCI DSS 3.0 Compliance Requirements with EventLog Analyzer >> Achieve PCI DSS 3.0 Compliant Status with Out-of-the-box PCI DSS Reports >> Are you Audit-Ready for PCI DSS 3.0 Compliance? Download White paper >> Comply to PCI DSS 3.0 Requirement 10 and 11.5 with EventLog Analyzer >> http://pubads.g.doubleclick.net/gampad/clk?id=154622311&iu=/4140/ostg.clktrk >> _______________________________________________ >> sleuthkit-users mailing list >> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users >> http://www.sleuthkit.org > -- -Ketil |