Skip to content

"KeyError: 'content'" when parsing MFT entries #4

@gabrielboliveira

Description

@gabrielboliveira

I'm trying to fix a bad Hard Disk, created the image with ddrescue /dev/sdb backup.img backup.log, then started RecuperaBit via pypy main.py backup.img -o output -s savefile.save. (got the tutorial from here).

When initializing (before hitting enter), it shows this warning message:
(Solved removing an ô character from the directory tree, will open another issue to separate them)

The script read all records from image, but when parsing MFT entries it crashed with following message:
(Just to let you know: this was the point where testdisk failed, because it couldn't find neither the MFT nor the MFT Mirror.)

INFO:root:First scan completed
INFO:root:Parsing MFT entries
Traceback (most recent call last):
  File "main.py", line 309, in <module>
    main()
  File "main.py", line 291, in main
    parts.update(scanner.get_partitions())
  File "/home/ubuntu/RecuperaBit/recuperabit/fs/ntfs.py", line 720, in get_partitions
    self.add_from_indx_root(parsed, part)
  File "/home/ubuntu/RecuperaBit/recuperabit/fs/ntfs.py", line 504, in add_from_indx_root
    if (attribute['content'] is None or
KeyError: 'content'

I'm using Ubuntu 16.04.1, python and pypy version below:

Python 2.7.10 (5.1.2+dfsg-1~16.04, Jun 16 2016, 17:37:42)
[PyPy 5.1.2 with GCC 5.3.1 20160413]

Tried running again, it found the .save file, read all relevant information and kept going till the same failure point: parsing MFT entries.

(Don't know if relevant information, but hope it helps: running Ubuntu Live via USB flash drive; the RecuperaBit downloaded directly via git clone on /home/ubuntu; .img, .save and output folder are saved on a mounted external HDD via USB 3.0)

Metadata

Metadata

Assignees

No one assigned

    Labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions