I'm using ubuntu 20.04 and a plaso docker (today latest) and some errors occur when using l2t. I'm using a hardware read only interface (tableau) and accessing directly the device.
$ docker run -it --rm -v /dev/sdb2:/dev/sdb2 --privileged -v "`pwd`":"`pwd`" -w "`pwd`" log2timeline/plaso log2timeline --no_vss --parsers win7 ntfs2.plaso /dev/sdb2
2021-05-07 18:36:00,837 [INFO] (MainProcess) PID:7 <data_location> Determined data location: /usr/share/plaso
2021-05-07 18:36:00,847 [INFO] (MainProcess) PID:7 <artifact_definitions> Determined artifact definitions path: /usr/share/artifacts
Checking availability and versions of dependencies.
[OK]
Unable to scan source with error: Unable to open file system with error: pyvshadow_volume_open_file_object: unable to open volume. libvshadow_ntfs_volume_header_read_data: invalid volume system signature. libvshadow_ntfs_volume_header_read_file_io_handle: unable to read NTFS volume header. libvshadow_volume_open_read_ntfs_volume_headers: unable to read backup NTFS volume header. libvshadow_volume_open_read: unable to read NTFS volume headers. libvshadow_volume_open_file_io_handle: unable to read from file IO handle..
I can read this partition using mmls and fls (sleuthkit).
How do I overcome this issue?
Best regards,
Aristeu