Bulk extractor error

337 views
Skip to first unread message

Chad Conrady

unread,
May 25, 2015, 2:58:14 PM5/25/15
to bitcurat...@googlegroups.com
Hi All,

I was running Bulk Extractor on an .aff image of a flash drive when I received an error message stating:

bulk_extractor Scanner terminated with exit value 137. Please check command syntax: bulk_extractor -o "/home/bcadmin/Desktop/Shared Folders and Media/sf_Born_Digital_Archived/Bulk Extractor Data" "/home/bcadmin/Desktop/Shared Folders and Media/sf_Born_Digital_Archived/FlashDrive_NoTitle.aff"

Has anyone seen this message before, and how to resolve it?

I am running BitCurator (v. 1.3.5) in a virtual environment with Oracle VM Virtual Box on a windows system. 



Thanks,


Chad

Kam Woods

unread,
May 28, 2015, 12:16:28 AM5/28/15
to bitcurat...@googlegroups.com
Hi Chad,

This indicates that bulk_extractor has crashed for some reason, but a stack trace or log output would be required to know why. It's possible you've found a bug in bulk_extractor, but it's more likely you've encountered a flaw in the AFFLIB code.

I understand this may not be a newly acquired device, but in general you should not be using AFF as a disk image format - it is no longer being supported, and the original author has requested that people use E01 (via libewf) instead.

One quick check you could try is exporting the raw disk image via the affconvert command-line tool, running bulk_extractor on that, and seeing if you run into the same issue. If so, you should report it on the bulk_extractor user list (also a Google Group).

Regards,

Kam


--
You received this message because you are subscribed to the Google Groups "BitCurator Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to bitcurator-use...@googlegroups.com.
To post to this group, send email to bitcurat...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/bitcurator-users/27dd8d6b-b13a-4c00-b07f-21028b33b879%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Chad Conrady

unread,
May 29, 2015, 10:15:11 AM5/29/15
to bitcurat...@googlegroups.com
Kam,

Thanks for your help.  I'll try using the E01 image format.

Chad

Chad Conrady

unread,
Jun 12, 2015, 3:43:29 PM6/12/15
to bitcurat...@googlegroups.com
Kam,

Using the E01 image format worked for the most part, but I notice that whenever I had all of the default scans selected along with xor and wordlist I always received the error 137.  I also tried a couple of other combinations (xor and base 16, worldlist and base 16, just xor, and just wordlist) these all resulted in successful scans. 

I am curious now on why just xor and wordlist scans would result in a error. Any ideas?

Best,

Chad

Kam Woods

unread,
Jun 12, 2015, 9:39:46 PM6/12/15
to bitcurat...@googlegroups.com
Chad,

You may wish to take this question to the bulk extractor users list and see if you get a direct response from Simson. (https://groups.google.com/forum/#!forum/bulk_extractor-users).

My first guess would be that you're running out of memory. How much RAM do you have assigned to the VM?

Regards,

Kam

Chad Conrady

unread,
Jun 26, 2015, 12:26:04 PM6/26/15
to bitcurat...@googlegroups.com
Kam,

Thanks for the link to the bulk extractor group.  There was already a post about the wordlist scan erroring out.  Simon's suggestion was to have about 64gig of ram to successfully run the scan. 

Best,

Chad
Reply all
Reply to author
Forward
0 new messages