sleuthkit-users

[sleuthkit-users] FLS on Windows Errors

[Joseph R. M. <jr....@gm...>]

System: Windows Vista x64
Package: Latest Windows binaries (TSK 3.1.1) via the .zip file
Unzipped to the run location along with the DLLs etc.

When running FLS through a batch file, I get this error:
Error stat(ing) image file (split_open -

Here is my command to call FLS:
C:\>"%TOOLDIR%\fls" –m C: –r \\.\C: >
"%TOOLDIR%\%LOGDIR%\%COMPUTERNAME%-files.txt"

To simplify, picture this:
C:\>"C:\Temp\Tools\fls" -m C: -r \\.\C: >
"C:\Temp\Tools\..\Logs\PC-files.txt"

Unfortunately, this usually happens when trying to use this within a batch
file, while usually working when I use it via command-line directly.  It
also seems to help if I navigate to the C:\ root in DOS before I execute the
command, although this is nowhere near full-proof as I cannot get it to
reliably execute in either scenario.

I have tried recompiling this with Visual Studio 2010, but have come across
great difficulty with libews and zlib.  Apparently even VS2008 projects need
to be converted to work, and assembly files are not supported.  Even so,
given that similar issues have considered to be bugs (current, as far as I
know), I am not sure recompiling will even fix it (
http://old.nabble.com/problems-running-sleuthkit-on-Windows-Server-2003-x64-td27189560.html
).

This is also a problem across several PCs in my batch file, not just my
own.  This has been tested on 32-bit Windows systems as well with the same
result.


Regards,
J.R. Murray

Re: [sleuthkit-users] FLS on Windows Errors

[Brian C. <ca...@sl...>]

The error is coming from split_open, which means that it thinks you are passing multiple file names for it to open as a split image.   I just tried to recreate this problem, but can't.  I used almost your exact example (leaving off your paths) and it worked as expected (from both the command line and a batch file). Can you confirm that it works if you replace "\\.\C:" with an image file?  

thanks,
brian


On Apr 21, 2010, at 4:54 PM, Joseph R. Murray wrote:

> System: Windows Vista x64
> Package: Latest Windows binaries (TSK 3.1.1) via the .zip file
> Unzipped to the run location along with the DLLs etc.
> 
> When running FLS through a batch file, I get this error:
> Error stat(ing) image file (split_open -
> 
> Here is my command to call FLS:
> C:\>"%TOOLDIR%\fls" –m C: –r \\.\C: > "%TOOLDIR%\%LOGDIR%\%COMPUTERNAME%-files.txt"
> 
> To simplify, picture this:
> C:\>"C:\Temp\Tools\fls" -m C: -r \\.\C: > "C:\Temp\Tools\..\Logs\PC-files.txt"
> 
> Unfortunately, this usually happens when trying to use this within a batch file, while usually working when I use it via command-line directly.  It also seems to help if I navigate to the C:\ root in DOS before I execute the command, although this is nowhere near full-proof as I cannot get it to reliably execute in either scenario.
> 
> I have tried recompiling this with Visual Studio 2010, but have come across great difficulty with libews and zlib.  Apparently even VS2008 projects need to be converted to work, and assembly files are not supported.  Even so, given that similar issues have considered to be bugs (current, as far as I know), I am not sure recompiling will even fix it (http://old.nabble.com/problems-running-sleuthkit-on-Windows-Server-2003-x64-td27189560.html).
> 
> This is also a problem across several PCs in my batch file, not just my own.  This has been tested on 32-bit Windows systems as well with the same result.
> 
> 
> Regards,
> J.R. Murray
> 
> ------------------------------------------------------------------------------
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

Re: [sleuthkit-users] FLS on Windows Errors

[Theodore P. <te...@gm...>]

I think I see what you're doing wrong.

I created a bat file and put these lines into it:

set TOOLDIR=bb
fls -m C: \\.\C: > "%TOOLDIR%-PC files.txt"

When I execute the bat file, it works and prints the following to console:

C:\temp2>fl.bat

C:\temp2>set TOOLDIR=bb

C:\temp2>fls -m C: \\.\C:  1>"bb-PC files.txt"

Now change the bat file to the following:

set TOOLDIR="bb"
fls -m C: \\.\C: > "%TOOLDIR%-PC files.txt"

When I execute the bat file now, it works and prints the following to console:

C:\temp2>fl.bat

C:\temp2>set TOOLDIR="bb"

C:\temp2>fls -m C: \\.\C:  1>""bb"-PC files.txt"

Now change the bat file to the following:

set TOOLDIR="b b b"
fls -m C: \\.\C: > "%TOOLDIR%-PC files.txt"

When I execute the bat file now, it fails and gives the split_open
error with the following console output:

C:\temp2>fl.bat

C:\temp2>set TOOLDIR="b b b"

C:\temp2>fls -m C: \\.\C:  b b"-PC files.txt" 1>""b
Error stat(ing) image file (split_open - \\.\C: - No such file or directory)

Notice how the quotation marks expand from the variable and then
causes the command line string to terminate in unintended ways. Also,
if you have an extra space character at the end of the variable or at
the end of the fls command line, you will also get similar unexpected
results.

So moral of the story, be very careful with whitespace and quotation
marks when writing batch scripts.

On Wed, Apr 21, 2010 at 4:54 PM, Joseph R. Murray <jr....@gm...> wrote:
> System: Windows Vista x64
> Package: Latest Windows binaries (TSK 3.1.1) via the .zip file
> Unzipped to the run location along with the DLLs etc.
>
> When running FLS through a batch file, I get this error:
> Error stat(ing) image file (split_open -
>
> Here is my command to call FLS:
> C:\>"%TOOLDIR%\fls" –m C: –r \\.\C: >
> "%TOOLDIR%\%LOGDIR%\%COMPUTERNAME%-files.txt"
>
> To simplify, picture this:
> C:\>"C:\Temp\Tools\fls" -m C: -r \\.\C: >
> "C:\Temp\Tools\..\Logs\PC-files.txt"
>
> Unfortunately, this usually happens when trying to use this within a batch
> file, while usually working when I use it via command-line directly.  It
> also seems to help if I navigate to the C:\ root in DOS before I execute the
> command, although this is nowhere near full-proof as I cannot get it to
> reliably execute in either scenario.
>
> I have tried recompiling this with Visual Studio 2010, but have come across
> great difficulty with libews and zlib.  Apparently even VS2008 projects need
> to be converted to work, and assembly files are not supported.  Even so,
> given that similar issues have considered to be bugs (current, as far as I
> know), I am not sure recompiling will even fix it
> (http://old.nabble.com/problems-running-sleuthkit-on-Windows-Server-2003-x64-td27189560.html).
>
> This is also a problem across several PCs in my batch file, not just my
> own.  This has been tested on 32-bit Windows systems as well with the same
> result.
>
>
> Regards,
> J.R. Murray
>
>
> ------------------------------------------------------------------------------
>
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>
>

Re: [sleuthkit-users] FLS on Windows Errors

[Joseph R. M. <jr....@gm...>]

Brian & Theodore - Thanks for the ideas.  For more detail, here are the
statements to declare the variables:

SET LOGDIR="..\Logs"
SET TOOLDIR=%~d0%~p0Tools

I have tried these lines in the batch file and had the same result:
fls –m C: –r \\.\C:
fls –m C: –r 7-ntfs-undel.dd

I have also tried specifying an image file but that hasn't worked either
(same error).  Perhaps it is good to note that I am using a .cmd file and
not a .bat file, although I have tried both with the same result.  I have
UAC enabled but I am running the command-prompt as an administrator before
executing the script, and FLS works by itself (most of the time) without the
script involved.

Does anyone have any ideas regarding this?
Brian, if there is anything you'd like me to test please let me know.

Re: [sleuthkit-users] FLS on Windows Errors

[Theodore P. <te...@gm...>]

Rename our .cmd file with a .txt extension and attach it to your
reply.  I'm curious if something in your script is causing it.

On Thu, Apr 22, 2010 at 9:53 AM, Joseph R. Murray <jr....@gm...> wrote:
> Brian & Theodore - Thanks for the ideas.  For more detail, here are the
> statements to declare the variables:
>
> SET LOGDIR="..\Logs"
> SET TOOLDIR=%~d0%~p0Tools
>
> I have tried these lines in the batch file and had the same result:
> fls –m C: –r \\.\C:
> fls –m C: –r 7-ntfs-undel.dd
>
> I have also tried specifying an image file but that hasn't worked either
> (same error).  Perhaps it is good to note that I am using a .cmd file and
> not a .bat file, although I have tried both with the same result.  I have
> UAC enabled but I am running the command-prompt as an administrator before
> executing the script, and FLS works by itself (most of the time) without the
> script involved.
>
> Does anyone have any ideas regarding this?
> Brian, if there is anything you'd like me to test please let me know.
>
>

Re: [sleuthkit-users] FLS on Windows Errors

[Joseph R. M. <jr....@gm...>]

Thanks for the idea.  I was able to figure it out.  I commented the @echo
off line at the top of the script, and realized that my FLS command-line
appeared to have upper-ASCII characters instead of hyphens when it was
presented in the command-prompt window.  I had pasted the FLS command into
the script from a web site and even though they appeared as hyphens, they
certainly were not interpreted as such.  It looked like:

fls ûm C: ûr \\.\C:

So I deleted those characters and replaced them with hyphens, and all seems
better now.  Thanks for your help even though it turned out to be such a
basic issue.


On Thu, Apr 22, 2010 at 5:04 PM, Theodore Pham <te...@gm...> wrote:

> Rename our .cmd file with a .txt extension and attach it to your
> reply.  I'm curious if something in your script is causing it.
>
> On Thu, Apr 22, 2010 at 9:53 AM, Joseph R. Murray <jr....@gm...>
> wrote:
> > Brian & Theodore - Thanks for the ideas.  For more detail, here are the
> > statements to declare the variables:
> >
> > SET LOGDIR="..\Logs"
> > SET TOOLDIR=%~d0%~p0Tools
> >
> > I have tried these lines in the batch file and had the same result:
> > fls –m C: –r \\.\C:
> > fls –m C: –r 7-ntfs-undel.dd
> >
> > I have also tried specifying an image file but that hasn't worked either
> > (same error).  Perhaps it is good to note that I am using a .cmd file and
> > not a .bat file, although I have tried both with the same result.  I have
> > UAC enabled but I am running the command-prompt as an administrator
> before
> > executing the script, and FLS works by itself (most of the time) without
> the
> > script involved.
> >
> > Does anyone have any ideas regarding this?
> > Brian, if there is anything you'd like me to test please let me know.
> >
> >
>