tsk_recover error

[Darren Love]

Hi everyone, I'm new to the group and also new to BitCurator and FRED.

My coworker is currently trying to extract the information from a .dd file running Brunnhilde in v. 2.0.10 of BitCurator. 

Everything runs fine for the first 55 files (carved out) but then we hit an error:

tsk_recover: fatfs_utils.c:271: fatfs_utf16_inode_str_2_utf8: Assertion `a_src_len > 0' failed

From what I could find, this appears to be an encoding error for UTF-16 conversion. 

My newbie question is, how can we bypass this error or run a command to accomodate for this error?

Also, is this Group where I should be asking this question re: Brunnhilde/tsk_recover?

Thanks!

Darren

[co...@digitalsleuth.ca]

Hi Darren,

Unfortunately this sounds more like a Brunnhilde/tsk_recover issue. I would recommend possibly reaching out to them to see if they might have more of an insight into this.

Cheers!

Corey

[Darren Love]

Thanks Corey, I’ll contact them to see what they say,

 

Darren

 

 

 

From: bitcurat...@googlegroups.com <bitcurat...@googlegroups.com> On Behalf Of co...@digitalsleuth.ca
Sent: March 17, 2025 11:07 AM
To: BitCurator Users <bitcurat...@googlegroups.com>
Subject: Re: tsk_recover error

 

[△EXTERNAL]

 

--
You received this message because you are subscribed to a topic in the Google Groups "BitCurator Users" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/bitcurator-users/72FoG9N__0o/unsubscribe.
To unsubscribe from this group and all its topics, send an email to bitcurator-use...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/bitcurator-users/205e101d-916c-406f-a924-2dda2d5b6430n%40googlegroups.com.

[Simson Garfinkel]

Hi. The error below is a bug in tsk_recover, part of SleuthKit. The error indicates that an assertion in the utility for the FAT file system has failed.

In fact, here is the failing statement:

https://github.com/sleuthkit/sleuthkit/blob/6f4f2f057dc4a42a4b2163ce237f3adfb5488d43/tsk/fs/fatfs_utils.c#L271

The error indicates that tsk_recover has asked to convert a 0-length string from UTF-16 to UTF-8. So my guess is that there is a consistency error in your input disk that is causing this to manifest as a bug, rather than being caught.

Can you share the disk image that resulted in this error?

--
You received this message because you are subscribed to the Google Groups "BitCurator Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to bitcurator-use...@googlegroups.com.

[Darren Love]

Thanks for all the info!

 

I’ll have to look into this further, pretty sure I won’t be able to share the disk image.

 

 

From: bitcurat...@googlegroups.com <bitcurat...@googlegroups.com> On Behalf Of Simson Garfinkel
Sent: March 18, 2025 1:38 AM
To: bitcurat...@googlegroups.com
Subject: Re: tsk_recover error

 

[△EXTERNAL]

 

Hi. The error below is a bug in tsk_recover, part of SleuthKit. The error indicates that an assertion in the utility for the FAT file system has failed.

To view this discussion visit https://groups.google.com/d/msgid/bitcurator-users/E933B249-7D85-48AE-B50E-1EA5B12FB513%40gmail.com.

[Simson Garfinkel]

I can try to make you a version of tsk_recover that might work, but it would be much easier if you could share the disk image...

To view this discussion visit https://groups.google.com/d/msgid/bitcurator-users/YT2PR01MB976140923B79809805FF92D1B4D82%40YT2PR01MB9761.CANPRD01.PROD.OUTLOOK.COM.