ValueError: cannot fit 'int' into an offset-sized integer (python3) - OverflowError: integer too large (pypy3) #88
Description
Hi,
I have a raw 750GB image of a drive which used to have one ntfs partition of that size,
but now its showing only a 449gb ntf partition and windows can not mount the partition ("unformatted").
First run of RecuperaBit works fine, then it throws following error:
(64bit debian 10 (buster) pypy3 / python3)
pypy3:
...
ERROR:root:Cannot handle multiple attribute $STANDARD_INFORMATION
ERROR:root:Cannot handle multiple attribute $STANDARD_INFORMATION
INFO:root:Parsing INDX records
INFO:root:Reading boot sectors
INFO:root:Repaired MFT entry #0 - $MFT in partition at offset 2048 from backup
INFO:root:Repaired MFT entry #1 - $MFTMirr in partition at offset 2048 from backup
INFO:root:Repaired MFT entry #2 - $LogFile in partition at offset 2048 from backup
DEBUG:root:Dropping bogus NTFS partition with MFT position 913644690 generated by MFT mirror of partition at offset 913639528
DEBUG:root:Dropping bogus NTFS partition with MFT position 913508696 generated by MFT mirror of partition at offset 913508680
DEBUG:root:Dropping bogus NTFS partition with MFT position 915820154 generated by MFT mirror of partition at offset 915814992
DEBUG:root:Dropping bogus NTFS partition with MFT position 915826346 generated by MFT mirror of partition at offset 915821184
DEBUG:root:Dropping bogus NTFS partition with MFT position 915832538 generated by MFT mirror of partition at offset 915827376
DEBUG:root:Dropping bogus NTFS partition with MFT position 915868434 generated by MFT mirror of partition at offset 915863272
DEBUG:root:Dropping bogus NTFS partition with MFT position 914665816 generated by MFT mirror of partition at offset 914665800
DEBUG:root:Dropping bogus NTFS partition with MFT position 977548198 generated by MFT mirror of partition at offset 977543036
DEBUG:root:Dropping bogus NTFS partition with MFT position 1357141790 generated by MFT mirror of partition at offset 1357136628
INFO:root:Finding partition geometry
INFO:root:Finalizing MFT reconstruction of partition at offset 2048
INFO:root:Adding extra attributes from $ATTRIBUTE_LIST
Traceback (most recent call last):
File "main.py", line 374, in <module>
main()
File "main.py", line 357, in main
parts.update(scanner.get_partitions())
File "/root/RecuperaBit/recuperabit/fs/ntfs.py", line 837, in get_partitions
self.finalize_reconstruction(part)
File "/root/RecuperaBit/recuperabit/fs/ntfs.py", line 673, in finalize_reconstruction
self.add_from_attribute_list(parsed, part, node.offset)
File "/root/RecuperaBit/recuperabit/fs/ntfs.py", line 628, in add_from_attribute_list
_integrate_attribute_list(parsed, part, image)
File "/root/RecuperaBit/recuperabit/fs/ntfs.py", line 219, in _integrate_attribute_list
dump = sectors(image, real_pos, length, 1)
File "/root/RecuperaBit/recuperabit/utils.py", line 44, in sectors
image.seek(offset * bsize)
OverflowError: integer too large
python3:
...
ERROR:root:Cannot handle multiple attribute $STANDARD_INFORMATION
ERROR:root:Cannot handle multiple attribute $STANDARD_INFORMATION
INFO:root:Parsing INDX records
INFO:root:Reading boot sectors
DEBUG:root:Dropping bogus NTFS partition with MFT position 914665816 generated by MFT mirror of partition at offset 914665800
INFO:root:Repaired MFT entry #0 - $MFT in partition at offset 2048 from backup
INFO:root:Repaired MFT entry #1 - $MFTMirr in partition at offset 2048 from backup
INFO:root:Repaired MFT entry #2 - $LogFile in partition at offset 2048 from backup
DEBUG:root:Dropping bogus NTFS partition with MFT position 977548198 generated by MFT mirror of partition at offset 977543036
DEBUG:root:Dropping bogus NTFS partition with MFT position 1357141790 generated by MFT mirror of partition at offset 1357136628
DEBUG:root:Dropping bogus NTFS partition with MFT position 913644690 generated by MFT mirror of partition at offset 913639528
DEBUG:root:Dropping bogus NTFS partition with MFT position 915820154 generated by MFT mirror of partition at offset 915814992
DEBUG:root:Dropping bogus NTFS partition with MFT position 915826346 generated by MFT mirror of partition at offset 915821184
DEBUG:root:Dropping bogus NTFS partition with MFT position 915832538 generated by MFT mirror of partition at offset 915827376
DEBUG:root:Dropping bogus NTFS partition with MFT position 915868434 generated by MFT mirror of partition at offset 915863272
DEBUG:root:Dropping bogus NTFS partition with MFT position 913508696 generated by MFT mirror of partition at offset 913508680
INFO:root:Finding partition geometry
INFO:root:Finalizing MFT reconstruction of partition at offset 914665800
INFO:root:Adding extra attributes from $ATTRIBUTE_LIST
INFO:root:Adding ghost entries from $INDEX_ALLOCATION
INFO:root:Finalizing MFT reconstruction of partition at offset 2048
INFO:root:Adding extra attributes from $ATTRIBUTE_LIST
Traceback (most recent call last):
File "main.py", line 374, in <module>
main()
File "main.py", line 357, in main
parts.update(scanner.get_partitions())
File "/root/RecuperaBit/recuperabit/fs/ntfs.py", line 837, in get_partitions
self.finalize_reconstruction(part)
File "/root/RecuperaBit/recuperabit/fs/ntfs.py", line 673, in finalize_reconstruction
self.add_from_attribute_list(parsed, part, node.offset)
File "/root/RecuperaBit/recuperabit/fs/ntfs.py", line 628, in add_from_attribute_list
_integrate_attribute_list(parsed, part, image)
File "/root/RecuperaBit/recuperabit/fs/ntfs.py", line 219, in _integrate_attribute_list
dump = sectors(image, real_pos, length, 1)
File "/root/RecuperaBit/recuperabit/utils.py", line 44, in sectors
image.seek(offset * bsize)
ValueError: cannot fit 'int' into an offset-sized integer
I can provide the image and logfile in a VM if needed.
Regards
Ralph