Skip to content

Unsupported L01 srce category format #205

@adenprince-relativity

Description

@adenprince-relativity

Some L01 files generated by EnCase 21.3 are receiving the following error:

libewf_single_files_parse_srce_category: invalid number of entries value out of bounds.
libewf_single_files_parse_utf8_string: unable to parse srce category.
libewf_single_files_read_data: unable to parse UTF-8 string.
libewf_internal_handle_open_read_segment_file_section_data: unable to parse single files.
libewf_internal_handle_open_read_segment_files: unable to read section data from segment file: 0.
libewf_internal_handle_open_file_io_pool: unable to read segment files.
libewf_handle_open_wide: unable to open handle using a file IO pool.

After removing the check that results in the invalid number of entries value out of bounds error above and rebuilding the library, those files receive this error:

libewf_single_files_parse_srce_category: unsupported empty line string: 22 - not empty.
libewf_single_files_parse_utf8_string: unable to parse srce category.
libewf_single_files_read_data: unable to parse UTF-8 string.
libewf_internal_handle_open_read_segment_file_section_data: unable to parse single files.
libewf_internal_handle_open_read_segment_files: unable to read section data from segment file: 0.
libewf_internal_handle_open_file_io_pool: unable to read segment files.
libewf_handle_open_wide: unable to open handle using a file IO pool.

Is it safe to remove the check that results in the unsupported empty line string: 22 - not empty error above? Are you aware of any settings in EnCase that would cause these errors? I'm not able to provide a test file. Thank you.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions