Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Aborting errors when resuming processing of multiple embedded virtual disks (master) #948

Closed
lfcnassif opened this issue Jan 28, 2022 · 1 comment
Closed

Aborting errors when resuming processing of multiple embedded virtual disks (master) #948

lfcnassif opened this issue Jan 28, 2022 · 1 comment
Assignees
@lfcnassif
Labels
bug

Comments

@lfcnassif
Copy link
Member

When #102 was implemented, resuming that kind of processing was not tested properly, and of course, is not working:

2022-01-28 16:52:15     [ERROR] [gpinf.indexer.IndexFiles]                      Processing Error:
java.lang.Exception: Worker-7 Error while processing vhd\recursive.vhd (1073742336bytes)
        at dpf.sp.gpinf.indexer.process.Worker.process(Worker.java:188) ~[iped-engine-4.0.0-snapshot.jar:?]
        at dpf.sp.gpinf.indexer.process.Worker.run(Worker.java:240) ~[iped-engine-4.0.0-snapshot.jar:?]
Caused by: java.lang.IndexOutOfBoundsException: Index -243 out of bounds for length 0
        at jdk.internal.util.Preconditions.outOfBounds(Unknown Source) ~[?:?]
        at jdk.internal.util.Preconditions.outOfBoundsCheckIndex(Unknown Source) ~[?:?]
        at jdk.internal.util.Preconditions.checkIndex(Unknown Source) ~[?:?]
        at java.util.Objects.checkIndex(Unknown Source) ~[?:?]
        at java.util.ArrayList.get(Unknown Source) ~[?:?]
        at dpf.sp.gpinf.indexer.datasource.SleuthkitReader.addItem(SleuthkitReader.java:904) ~[iped-engine-4.0.0-snapshot.jar:?]
        at dpf.sp.gpinf.indexer.datasource.SleuthkitReader.addEvidenceFile(SleuthkitReader.java:840) ~[iped-engine-4.0.0-snapshot.jar:?]
        at dpf.sp.gpinf.indexer.datasource.SleuthkitReader.addContentAndGetItem(SleuthkitReader.java:823) ~[iped-engine-4.0.0-snapshot.jar:?]
        at dpf.sp.gpinf.indexer.datasource.SleuthkitReader.addContent(SleuthkitReader.java:681) ~[iped-engine-4.0.0-snapshot.jar:?]
        at dpf.sp.gpinf.indexer.datasource.SleuthkitReader.addItems(SleuthkitReader.java:672) ~[iped-engine-4.0.0-snapshot.jar:?]
        at dpf.sp.gpinf.indexer.datasource.SleuthkitReader.readItensAdded(SleuthkitReader.java:632) ~[iped-engine-4.0.0-snapshot.jar:?]
        at dpf.sp.gpinf.indexer.datasource.SleuthkitReader.read(SleuthkitReader.java:464) ~[iped-engine-4.0.0-snapshot.jar:?]
        at dpf.sp.gpinf.indexer.process.task.EmbeddedDiskProcessTask.process(EmbeddedDiskProcessTask.java:125) ~[iped-engine-4.0.0-snapshot.jar:?]
        at dpf.sp.gpinf.indexer.process.task.AbstractTask.processMonitorTimeout(AbstractTask.java:253) ~[iped-engine-4.0.0-snapshot.jar:?]
        at dpf.sp.gpinf.indexer.process.task.AbstractTask.processAndSendToNextTask(AbstractTask.java:184) ~[iped-engine-4.0.0-snapshot.jar:?]
        at dpf.sp.gpinf.indexer.process.task.AbstractTask.sendToNextTask(AbstractTask.java:229) ~[iped-engine-4.0.0-snapshot.jar:?]
        at dpf.sp.gpinf.indexer.process.task.AbstractTask.processAndSendToNextTask(AbstractTask.java:192) ~[iped-engine-4.0.0-snapshot.jar:?]
        at dpf.sp.gpinf.indexer.process.task.AbstractTask.sendToNextTask(AbstractTask.java:229) ~[iped-engine-4.0.0-snapshot.jar:?]
        at dpf.sp.gpinf.indexer.process.task.AbstractTask.processAndSendToNextTask(AbstractTask.java:192) ~[iped-engine-4.0.0-snapshot.jar:?]
        at dpf.sp.gpinf.indexer.process.task.AbstractTask.sendToNextTask(AbstractTask.java:229) ~[iped-engine-4.0.0-snapshot.jar:?]
        at dpf.sp.gpinf.indexer.process.task.AbstractTask.processAndSendToNextTask(AbstractTask.java:192) ~[iped-engine-4.0.0-snapshot.jar:?]
        at dpf.sp.gpinf.indexer.process.task.AbstractTask.sendToNextTask(AbstractTask.java:229) ~[iped-engine-4.0.0-snapshot.jar:?]
        at dpf.sp.gpinf.indexer.process.task.AbstractTask.processAndSendToNextTask(AbstractTask.java:192) ~[iped-engine-4.0.0-snapshot.jar:?]
        at dpf.sp.gpinf.indexer.process.task.AbstractTask.sendToNextTask(AbstractTask.java:229) ~[iped-engine-4.0.0-snapshot.jar:?]
        at dpf.sp.gpinf.indexer.process.task.AbstractTask.processAndSendToNextTask(AbstractTask.java:192) ~[iped-engine-4.0.0-snapshot.jar:?]
        at dpf.sp.gpinf.indexer.process.task.AbstractTask.sendToNextTask(AbstractTask.java:229) ~[iped-engine-4.0.0-snapshot.jar:?]
        at dpf.sp.gpinf.indexer.process.task.AbstractTask.processAndSendToNextTask(AbstractTask.java:192) ~[iped-engine-4.0.0-snapshot.jar:?]
        at dpf.sp.gpinf.indexer.process.task.AbstractTask.sendToNextTask(AbstractTask.java:229) ~[iped-engine-4.0.0-snapshot.jar:?]
        at dpf.sp.gpinf.indexer.process.task.AbstractTask.processAndSendToNextTask(AbstractTask.java:192) ~[iped-engine-4.0.0-snapshot.jar:?]
        at dpf.sp.gpinf.indexer.process.task.AbstractTask.sendToNextTask(AbstractTask.java:229) ~[iped-engine-4.0.0-snapshot.jar:?]
        at dpf.sp.gpinf.indexer.process.task.AbstractTask.processAndSendToNextTask(AbstractTask.java:192) ~[iped-engine-4.0.0-snapshot.jar:?]
        at dpf.sp.gpinf.indexer.process.task.AbstractTask.sendToNextTask(AbstractTask.java:229) ~[iped-engine-4.0.0-snapshot.jar:?]
        at dpf.sp.gpinf.indexer.process.task.AbstractTask.processAndSendToNextTask(AbstractTask.java:192) ~[iped-engine-4.0.0-snapshot.jar:?]
        at dpf.sp.gpinf.indexer.process.task.AbstractTask.sendToNextTask(AbstractTask.java:229) ~[iped-engine-4.0.0-snapshot.jar:?]
        at dpf.sp.gpinf.indexer.process.task.AbstractTask.processAndSendToNextTask(AbstractTask.java:192) ~[iped-engine-4.0.0-snapshot.jar:?]
        at dpf.sp.gpinf.indexer.process.task.AbstractTask.sendToNextTask(AbstractTask.java:229) ~[iped-engine-4.0.0-snapshot.jar:?]
        at dpf.sp.gpinf.indexer.process.task.AbstractTask.processAndSendToNextTask(AbstractTask.java:192) ~[iped-engine-4.0.0-snapshot.jar:?]
@lfcnassif lfcnassif added the bug label Jan 28, 2022
@lfcnassif lfcnassif self-assigned this Jan 28, 2022
@lfcnassif
Copy link
Member Author

And also this NPE:

java.lang.Exception: Worker-8 Error while processing vhd/recursive.vhd/vol_vol2/splited/dd/raw.017 (10485760bytes)
        at dpf.sp.gpinf.indexer.process.Worker.process(Worker.java:188) ~[iped-engine-4.0.0-snapshot.jar:?]
        at dpf.sp.gpinf.indexer.process.Worker.run(Worker.java:240) ~[iped-engine-4.0.0-snapshot.jar:?]
Caused by: java.lang.NullPointerException
        at dpf.sp.gpinf.indexer.util.SleuthkitClient.get(SleuthkitClient.java:114) ~[iped-engine-4.0.0-snapshot.jar:?]
        at gpinf.dev.data.Item.getStream(Item.java:677) ~[iped-engine-4.0.0-snapshot.jar:?]
        at gpinf.dev.data.Item.getBufferedStream(Item.java:336) ~[iped-engine-4.0.0-snapshot.jar:?]
        at dpf.sp.gpinf.indexer.process.task.EntropyTask.process(EntropyTask.java:54) ~[iped-engine-4.0.0-snapshot.jar:?]
        at dpf.sp.gpinf.indexer.process.task.AbstractTask.processMonitorTimeout(AbstractTask.java:253) ~[iped-engine-4.0.0-snapshot.jar:?]
        at dpf.sp.gpinf.indexer.process.task.AbstractTask.processAndSendToNextTask(AbstractTask.java:184) ~[iped-engine-4.0.0-snapshot.jar:?]
        at dpf.sp.gpinf.indexer.process.task.AbstractTask.sendToNextTask(AbstractTask.java:229) ~[iped-engine-4.0.0-snapshot.jar:?]
        at dpf.sp.gpinf.indexer.process.task.AbstractTask.processAndSendToNextTask(AbstractTask.java:192) ~[iped-engine-4.0.0-snapshot.jar:?]
        at dpf.sp.gpinf.indexer.process.task.AbstractTask.sendToNextTask(AbstractTask.java:229) ~[iped-engine-4.0.0-snapshot.jar:?]
        at dpf.sp.gpinf.indexer.process.task.AbstractTask.processAndSendToNextTask(AbstractTask.java:192) ~[iped-engine-4.0.0-snapshot.jar:?]
        at dpf.sp.gpinf.indexer.process.task.AbstractTask.sendToNextTask(AbstractTask.java:229) ~[iped-engine-4.0.0-snapshot.jar:?]
        at dpf.sp.gpinf.indexer.process.task.AbstractTask.processAndSendToNextTask(AbstractTask.java:192) ~[iped-engine-4.0.0-snapshot.jar:?]
        at dpf.sp.gpinf.indexer.process.task.AbstractTask.sendToNextTask(AbstractTask.java:229) ~[iped-engine-4.0.0-snapshot.jar:?]
        at dpf.sp.gpinf.indexer.process.task.AbstractTask.processAndSendToNextTask(AbstractTask.java:192) ~[iped-engine-4.0.0-snapshot.jar:?]
        at dpf.sp.gpinf.indexer.process.task.AbstractTask.sendToNextTask(AbstractTask.java:229) ~[iped-engine-4.0.0-snapshot.jar:?]
        at dpf.sp.gpinf.indexer.process.task.PythonTask.sendToNextTask(PythonTask.java:261) ~[iped-engine-4.0.0-snapshot.jar:?]
        at dpf.sp.gpinf.indexer.process.task.AbstractTask.processAndSendToNextTask(AbstractTask.java:192) ~[iped-engine-4.0.0-snapshot.jar:?]

lfcnassif added a commit that referenced this issue Jan 28, 2022
@lfcnassif
#948: don't delete TSK IDs of embedded disks, update startIDs/lastIDs
dd43b5a
lfcnassif added a commit that referenced this issue Jan 28, 2022
@lfcnassif
fix #948 NPE due to TskServers not started when reading items from index
2c8180c
lfcnassif added a commit that referenced this issue Jan 28, 2022
@lfcnassif
#948: just delete TSK IDs if evidence is root, update startIDs/lastIDs
37124e4
lfcnassif added a commit that referenced this issue Feb 10, 2022
@lfcnassif
fix #948 NPE due to TskServers not started when reading items from index
f795c47 
Conflicts:
	iped-engine/src/main/java/dpf/sp/gpinf/indexer/datasource/SleuthkitReader.java
	iped-engine/src/main/java/dpf/sp/gpinf/indexer/process/Manager.java
lfcnassif added a commit that referenced this issue Feb 10, 2022
@lfcnassif
#948: just delete TSK IDs if evidence is root, update startIDs/lastIDs
d328c2e 
Conflicts:
	iped-engine/src/main/java/dpf/sp/gpinf/indexer/datasource/SleuthkitReader.java
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@lfcnassif lfcnassif

Labels
bug
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@lfcnassif