[prev in list] [next in list] [prev in thread] [next in thread] 

List:       sleuthkit-users
Subject:    Re: [sleuthkit-users] Problem in opening volume/filesystem in multithreaded application
From:       bryan cooper <bryan.co511 () gmail ! com>
Date:       2012-08-30 5:56:24
Message-ID: CAHWBb2OmvoCQTz4KoM_aLO8=m+_UbDyLyHD09s+qFhkeYDDgTA () mail ! gmail ! com
[Download RAW message or body]

Hi Again,
I converted E01 files to the raw images but the issue has reoccured.
What I have done is created a class called Image that wraps the
TskVsInfo, TskFsInfo objects.
I'm using managed C++ to create threads and in each of the threads an
object of Image class is created to process E01 file.
I'm relying completely on the Sleuthkit for handling the encase image
and do not access the libewf handle directly.
It is my assumption that this will create seperate libewf handle.
Please correct me if I am wrong.
Thanks,
Bryan

On Wed, Aug 29, 2012 at 12:29 AM, Simson Garfinkel <simsong@acm.org> wrote:
> You could have a separate libewf handle for each thread....
> 
> On Aug 28, 2012, at 2:27 PM, Brian Carrier <carrier@sleuthkit.org> wrote:
> 
> > If you convert the E01 files to raw images, does it work?  We added locks around \
> > the E01 reads because it is not thread safe, so this is a bit surprising. 
> > thanks,
> > brian
> > 
> > 
> > 
> > On Aug 27, 2012, at 7:54 AM, bryan cooper wrote:
> > 
> > > Hi,
> > > I have created an application using C++ wrapper of Sleuthkit 4.0.0b1
> > > to process Encase Image(E01).
> > > The application works fine when it is single threaded but in case of
> > > multithreading it does not work always.
> > > I'm using two sample encase images to test the application.
> > > 
> > > First encase image does not have volume system information but has
> > > FAT16 filesystem in it.
> > > The problem occurs sometimes while opening the filesystem. The error
> > > message tells us that it cannot determine filesystem type.
> > > 
> > > Second image consists of 5 mac partitions.Among them 4 have HFS
> > > filesystem and 1 has UFS filesystem.
> > > The error message tells us that it cannot determine partition type.
> > > The problem seems to occur due to failing of opening of volume.
> > > 
> > > Could you please help on this matter?
> > > 
> > > Thanks,
> > > Bryan
> > > 
> > > ------------------------------------------------------------------------------
> > > Live Security Virtual Conference
> > > Exclusive live event will cover all the ways today's security and
> > > threat landscape has changed and how IT managers can respond. Discussions
> > > will include endpoint security, mobile security and the latest in malware
> > > threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> > > _______________________________________________
> > > sleuthkit-users mailing list
> > > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> > > http://www.sleuthkit.org
> > 
> > 
> > ------------------------------------------------------------------------------
> > Live Security Virtual Conference
> > Exclusive live event will cover all the ways today's security and
> > threat landscape has changed and how IT managers can respond. Discussions
> > will include endpoint security, mobile security and the latest in malware
> > threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> > _______________________________________________
> > sleuthkit-users mailing list
> > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> > http://www.sleuthkit.org
> 

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org


[prev in list] [next in list] [prev in thread] [next in thread]