no_vss not switching off vss check

42 views
Skip to first unread message

Aristeu Jr

unread,
May 7, 2021, 2:39:06 PM5/7/21
to log2timeline-discuss

I'm using ubuntu 20.04 and a plaso docker (today latest) and some errors occur when using l2t. I'm using a hardware read only interface (tableau) and accessing directly the device. 

$ docker run -it --rm -v /dev/sdb2:/dev/sdb2 --privileged -v "`pwd`":"`pwd`" -w "`pwd`" log2timeline/plaso log2timeline --no_vss --parsers win7 ntfs2.plaso /dev/sdb2
2021-05-07 18:36:00,837 [INFO] (MainProcess) PID:7 <data_location> Determined data location: /usr/share/plaso
2021-05-07 18:36:00,847 [INFO] (MainProcess) PID:7 <artifact_definitions> Determined artifact definitions path: /usr/share/artifacts
Checking availability and versions of dependencies.
[OK]

Unable to scan source with error: Unable to open file system with error: pyvshadow_volume_open_file_object: unable to open volume. libvshadow_ntfs_volume_header_read_data: invalid volume system signature. libvshadow_ntfs_volume_header_read_file_io_handle: unable to read NTFS volume header. libvshadow_volume_open_read_ntfs_volume_headers: unable to read backup NTFS volume header. libvshadow_volume_open_read: unable to read NTFS volume headers. libvshadow_volume_open_file_io_handle: unable to read from file IO handle..

I can read this partition using mmls and fls (sleuthkit).
How do I overcome this issue?

Best regards,
Aristeu
Reply all
Reply to author
Forward
0 new messages