dfxml.py problems with idifference

[D M]

I'm new to using this (and Python) so I hope I'm just being stupid.

When I try "python idifference image1.raw image2.raw > results"

I encounter:
File "/home/xxx/afflib/sleuthkit/tools/fiwalk/python/dfxml.py", line
246, in __init__
if type(val)==str or type(val)==unicode:
UnboundLocalError: local variable 'unicode' referenced before
assignment

Commenting out the check for version 3 near line 246:

def __init__(self,val):
#if sys.version_info >= (3,0):
# unicode = str
if type(val)==str or type(val)==unicode:
#Test for ISO format - "YYYY-MM-DD" should have hyphen at
val[4]

gets me past this problem, although I'm not sure I understand why.

Running again gets me further to:

File "/home/xxx/afflib/sleuthkit/tools/fiwalk/python/dfxml.py", line
79, in parse_iso8601
raise RuntimeError("parse_iso8601: ISO8601 format {} not
recognized".format(ts))
RuntimeError: parse_iso8601: ISO8601 format 2009-12-02T05:00:00 not
recognized

This appears to be a failure to recognize a file type ( a TrueCrypt
container I think) so it aborts.
Commenting out the "raise RuntimeError" and replacing it with a
constant return:

def parse_iso8601(ts):
import datetime
Z = ts.find('Z')
if Z>0:
return datetime.datetime.strptime(ts[:Z],"%Y-%m-%dT%H:%M:%S")
return 2001-01-01-01-01-01-01
#raise RuntimeError("parse_iso8601: ISO8601 format {} not
recognized".format(ts))

allows my idifference to complete.

I have not seen anyone else with these problems so I have to doubt
that show stopper bugs like this are real as opposed to something I'm
doing wrong.

Help please!

[Simson Garfinkel]

Dave,

When filing a bug report, please indicate:

1. Are you using Python 2 or Python 3? Which version?

2. Which version of dfxml.py are you using?

3. Which version of fiwalk are you using?

4. What generated he DFXML file?

You're welcome to send this to me, rather than the list.

Simson

> --
> You received this message because you are subscribed to the Google Groups "aff-discuss" group.
> To post to this group, send email to aff-d...@googlegroups.com.
> To unsubscribe from this group, send email to aff-discuss...@googlegroups.com.
> For more options, visit this group at http://groups.google.com/group/aff-discuss?hl=en.
>