From chapletci at gmail.com Thu Jun 2 06:10:20 2011 From: chapletci at gmail.com (Yang SiHyeon) Date: Thu, 2 Jun 2011 13:10:20 +0900 Subject: [dff-devel] Problem during translation work...(resend) Message-ID: Hi. this is SiHyeon Yang (Hans) During my translation work of this DFF to Korean, I am using 1.1.0 version of DFF source to test my Korean translation. When I build release version in Visual Studio 2005 for Windows compilation, I am suffering a lot of error and I think zip type of source file is missing some files like "libpff.h", "afflilb.h", and etc. like attached error list from Visual Studio 2005. So, I tried to use tarball type of source code which is not working on my computer When I check md5, zip type is ok but tarball type is wrong. My dff-src-1.1.0.tar.gz's md5 is below. 5c1456db63dba6514c8642ac12182346 *dff-src-1.1.0.tar.gz I downloaded and did md5 it twice. Help me to solve all these errors and problems to test my translation work. Have a good day... Error 22 error C2065: 'GET_LENGTH_INFORMATION' : undeclared identifier f:\DFF\dff-1.1.0\api\devices\wmidev.cpp 91 Error 23 error C2146: syntax error : missing ';' before identifier 'diskSize' f:\DFF\dff-1.1.0\api\devices\wmidev.cpp 91 Error 24 error C2065: 'diskSize' : undeclared identifier f:\DFF\dff-1.1.0\api\devices\wmidev.cpp 91 Error 25 error C2065: 'FSCTL_ALLOW_EXTENDED_DASD_IO' : undeclared identifier f:\DFF\dff-1.1.0\api\devices\wmidev.cpp 93 Error 26 error C2065: 'IOCTL_DISK_GET_LENGTH_INFO' : undeclared identifier f:\DFF\dff-1.1.0\api\devices\wmidev.cpp 94 Error 27 error C2070: ''unknown-type'': illegal sizeof operand f:\DFF\dff-1.1.0\api\devices\wmidev.cpp 94 Error 28 error C2228: left of '.Length' must have class/struct/union f:\DFF\dff-1.1.0\api\devices\wmidev.cpp 97 Error 29 error C2228: left of '.QuadPart' must have class/struct/union f:\DFF\dff-1.1.0\api\devices\wmidev.cpp 97 Error 30 error C3861: 'CoInitializeEx': identifier not found f:\DFF\dff-1.1.0\api\devices\wmidev.cpp 114 Error 31 error C2065: 'EOAC_NONE' : undeclared identifier f:\DFF\dff-1.1.0\api\devices\wmidev.cpp 121 Error 32 error C3861: 'CoInitializeSecurity': identifier not found f:\DFF\dff-1.1.0\api\devices\wmidev.cpp 120 Error 33 error C3861: 'CoSetProxyBlanket': identifier not found f:\DFF\dff-1.1.0\api\devices\wmidev.cpp 141 Error 50 fatal error C1083: Cannot open include file: 'libpff.h': No such file or directory f:\dff\dff-1.1.0\modules\mailbox\pff\pff_common.hpp 26 Error 51 fatal error C1083: Cannot open include file: 'libpff.h': No such file or directory f:\dff\dff-1.1.0\modules\mailbox\pff\pff_common.hpp 26 Error 52 fatal error C1083: Cannot open include file: 'libpff.h': No such file or directory f:\dff\dff-1.1.0\modules\mailbox\pff\pff_common.hpp 26 Error 53 fatal error C1083: Cannot open include file: 'libpff.h': No such file or directory f:\dff\dff-1.1.0\modules\mailbox\pff\pff_common.hpp 26 Error 54 fatal error C1083: Cannot open include file: 'libpff.h': No such file or directory f:\dff\dff-1.1.0\modules\mailbox\pff\pff_common.hpp 26 Error 55 fatal error C1083: Cannot open include file: 'libpff.h': No such file or directory f:\dff\dff-1.1.0\modules\mailbox\pff\pff_common.hpp 26 Error 56 fatal error C1083: Cannot open include file: 'libpff.h': No such file or directory f:\dff\dff-1.1.0\modules\mailbox\pff\pff_common.hpp 26 Error 57 fatal error C1083: Cannot open include file: 'libpff.h': No such file or directory f:\dff\dff-1.1.0\modules\mailbox\pff\pff_common.hpp 26 Error 58 fatal error C1083: Cannot open include file: 'libpff.h': No such file or directory f:\dff\dff-1.1.0\modules\mailbox\pff\pff_common.hpp 26 Error 61 fatal error C1083: Cannot open include file: 'libpff.h': No such file or directory f:\dff\dff-1.1.0\modules\mailbox\pff\pff_common.hpp 26 Error 62 fatal error C1083: Cannot open include file: 'libpff.h': No such file or directory f:\dff\dff-1.1.0\modules\mailbox\pff\pff_common.hpp 26 Error 63 fatal error C1083: Cannot open include file: 'libpff.h': No such file or directory f:\dff\dff-1.1.0\modules\mailbox\pff\pff_common.hpp 26 Error 64 fatal error C1083: Cannot open include file: 'libpff.h': No such file or directory f:\dff\dff-1.1.0\modules\mailbox\pff\pff_common.hpp 26 Error 65 fatal error C1083: Cannot open include file: 'libpff.h': No such file or directory f:\dff\dff-1.1.0\modules\mailbox\pff\pff_common.hpp 26 Error 66 fatal error C1083: Cannot open include file: 'libpff.h': No such file or directory f:\dff\dff-1.1.0\modules\mailbox\pff\pff_common.hpp 26 Error 67 fatal error C1083: Cannot open include file: 'libpff.h': No such file or directory f:\dff\dff-1.1.0\modules\mailbox\pff\pff_common.hpp 26 Error 110 error C2065: 'FSCTL_ALLOW_EXTENDED_DASD_IO' : undeclared identifier f:\DFF\dff-1.1.0\modules\connector\devices\wdevices.cpp 129 Error 111 error C2065: 'GET_LENGTH_INFORMATION' : undeclared identifier f:\DFF\dff-1.1.0\modules\connector\devices\wdevices.cpp 132 Error 112 error C2146: syntax error : missing ';' before identifier 'diskSize' f:\DFF\dff-1.1.0\modules\connector\devices\wdevices.cpp 132 Error 113 error C2065: 'diskSize' : undeclared identifier f:\DFF\dff-1.1.0\modules\connector\devices\wdevices.cpp 132 Error 114 error C2065: 'IOCTL_DISK_GET_LENGTH_INFO' : undeclared identifier f:\DFF\dff-1.1.0\modules\connector\devices\wdevices.cpp 133 Error 115 error C2070: ''unknown-type'': illegal sizeof operand f:\DFF\dff-1.1.0\modules\connector\devices\wdevices.cpp 133 Error 116 error C2228: left of '.Length' must have class/struct/union f:\DFF\dff-1.1.0\modules\connector\devices\wdevices.cpp 134 Error 117 error C2228: left of '.QuadPart' must have class/struct/union f:\DFF\dff-1.1.0\modules\connector\devices\wdevices.cpp 134 Error 139 fatal error C1083: Cannot open include file: 'afflib/afflib.h': No such file or directory f:\dff\dff-1.1.0\modules\connector\aff\aff.hpp 34 Error 140 fatal error C1083: Cannot open include file: 'afflib/afflib.h': No such file or directory f:\dff\dff-1.1.0\modules\connector\aff\aff.hpp 34 Error 141 fatal error C1083: Cannot open include file: 'afflib/afflib.h': No such file or directory f:\dff\dff-1.1.0\modules\connector\aff\aff.hpp 34 -- =================================================== *SiHyeon(Hans) Yang.* Chaple the Customizing Blue IceCream ChapleLab Email) c hapletci at gmail.com Blog ) www.ctciblog.net ==================================================== -------------- next part -------------- An HTML attachment was scrubbed... URL: From fba at arxsys.fr Thu Jun 2 13:43:35 2011 From: fba at arxsys.fr (=?UTF-8?B?RnLDqWTDqXJpYyBCYWd1ZWxpbg==?=) Date: Thu, 02 Jun 2011 11:43:35 +0000 Subject: [dff-devel] Problem during translation work...(resend) In-Reply-To: References: Message-ID: <4DE77767.3070807@arxsys.fr> Hi ! First of all, glad to read that someone is working on Korean translation. Concerning your issue, I first need some lightening. Are you translating modules too (cpp and python both) or just the GUI ? If you just want to translate the GUI, be aware that you do not need to compile the framework from sources. You only need to use Qt Linguist and follow this HowTo http://wiki.digital-forensic.org/index.php/Translate_DFF. Either you want to translate modules or not, you have to be able to compile the framework. Did you follow the process describe at http://wiki.digital-forensic.org/index.php/Windows_compilation ? If so, it can come from your version of Visual Studio which could be too old. We are no longer using VS 2005 but Visual Studio 2010 Express to compile the framework. This version is freely available at http://www.microsoft.com/express/Downloads/#2010-Visual-CPP. I suggest you to download and install it and then try to compile the framework from this version. If there are still issues, we will investigate further. Regards, On 06/02/2011 04:10 AM, Yang SiHyeon wrote: > Hi. this is SiHyeon Yang (Hans) > > During my translation work of this DFF to Korean, > > I am using 1.1.0 version of DFF source to test my Korean translation. > > When I build release version in Visual Studio 2005 for Windows compilation, > > I am suffering a lot of error and I think zip type of source file is missing > some files like "libpff.h", "afflilb.h", and etc. > > like attached error list from Visual Studio 2005. > > So, I tried to use tarball type of source code which is not working on my computer > > When I check md5, zip type is ok but tarball type is wrong. > > My dff-src-1.1.0.tar.gz's md5 is below. > > 5c1456db63dba6514c8642ac12182346 *dff-src-1.1.0.tar.gz > > I downloaded and did md5 it twice. > > Help me to solve all these errors and problems to test my translation work. > > Have a good day... > > Error22error C2065: 'GET_LENGTH_INFORMATION' : undeclared > identifierf:\DFF\dff-1.1.0\api\devices\wmidev.cpp91 > Error23error C2146: syntax error : missing ';' before identifier > 'diskSize'f:\DFF\dff-1.1.0\api\devices\wmidev.cpp91 > Error24error C2065: 'diskSize' : undeclared > identifierf:\DFF\dff-1.1.0\api\devices\wmidev.cpp91 > Error25error C2065: 'FSCTL_ALLOW_EXTENDED_DASD_IO' : undeclared > identifierf:\DFF\dff-1.1.0\api\devices\wmidev.cpp93 > Error26error C2065: 'IOCTL_DISK_GET_LENGTH_INFO' : undeclared > identifierf:\DFF\dff-1.1.0\api\devices\wmidev.cpp94 > Error27error C2070: ''unknown-type'': illegal sizeof > operandf:\DFF\dff-1.1.0\api\devices\wmidev.cpp94 > Error28error C2228: left of '.Length' must have > class/struct/unionf:\DFF\dff-1.1.0\api\devices\wmidev.cpp97 > Error29error C2228: left of '.QuadPart' must have > class/struct/unionf:\DFF\dff-1.1.0\api\devices\wmidev.cpp97 > Error30error C3861: 'CoInitializeEx': identifier not > foundf:\DFF\dff-1.1.0\api\devices\wmidev.cpp114 > Error31error C2065: 'EOAC_NONE' : undeclared > identifierf:\DFF\dff-1.1.0\api\devices\wmidev.cpp121 > Error32error C3861: 'CoInitializeSecurity': identifier not > foundf:\DFF\dff-1.1.0\api\devices\wmidev.cpp120 > Error33error C3861: 'CoSetProxyBlanket': identifier not > foundf:\DFF\dff-1.1.0\api\devices\wmidev.cpp141 > Error50fatal error C1083: Cannot open include file: 'libpff.h': No such file or > directoryf:\dff\dff-1.1.0\modules\mailbox\pff\pff_common.hpp26 > Error51fatal error C1083: Cannot open include file: 'libpff.h': No such file or > directoryf:\dff\dff-1.1.0\modules\mailbox\pff\pff_common.hpp26 > Error52fatal error C1083: Cannot open include file: 'libpff.h': No such file or > directoryf:\dff\dff-1.1.0\modules\mailbox\pff\pff_common.hpp26 > Error53fatal error C1083: Cannot open include file: 'libpff.h': No such file or > directoryf:\dff\dff-1.1.0\modules\mailbox\pff\pff_common.hpp26 > Error54fatal error C1083: Cannot open include file: 'libpff.h': No such file or > directoryf:\dff\dff-1.1.0\modules\mailbox\pff\pff_common.hpp26 > Error55fatal error C1083: Cannot open include file: 'libpff.h': No such file or > directoryf:\dff\dff-1.1.0\modules\mailbox\pff\pff_common.hpp26 > Error56fatal error C1083: Cannot open include file: 'libpff.h': No such file or > directoryf:\dff\dff-1.1.0\modules\mailbox\pff\pff_common.hpp26 > Error57fatal error C1083: Cannot open include file: 'libpff.h': No such file or > directoryf:\dff\dff-1.1.0\modules\mailbox\pff\pff_common.hpp26 > Error58fatal error C1083: Cannot open include file: 'libpff.h': No such file or > directoryf:\dff\dff-1.1.0\modules\mailbox\pff\pff_common.hpp26 > Error61fatal error C1083: Cannot open include file: 'libpff.h': No such file or > directoryf:\dff\dff-1.1.0\modules\mailbox\pff\pff_common.hpp26 > Error62fatal error C1083: Cannot open include file: 'libpff.h': No such file or > directoryf:\dff\dff-1.1.0\modules\mailbox\pff\pff_common.hpp26 > Error63fatal error C1083: Cannot open include file: 'libpff.h': No such file or > directoryf:\dff\dff-1.1.0\modules\mailbox\pff\pff_common.hpp26 > Error64fatal error C1083: Cannot open include file: 'libpff.h': No such file or > directoryf:\dff\dff-1.1.0\modules\mailbox\pff\pff_common.hpp26 > Error65fatal error C1083: Cannot open include file: 'libpff.h': No such file or > directoryf:\dff\dff-1.1.0\modules\mailbox\pff\pff_common.hpp26 > Error66fatal error C1083: Cannot open include file: 'libpff.h': No such file or > directoryf:\dff\dff-1.1.0\modules\mailbox\pff\pff_common.hpp26 > Error67fatal error C1083: Cannot open include file: 'libpff.h': No such file or > directoryf:\dff\dff-1.1.0\modules\mailbox\pff\pff_common.hpp26 > Error110error C2065: 'FSCTL_ALLOW_EXTENDED_DASD_IO' : undeclared > identifierf:\DFF\dff-1.1.0\modules\connector\devices\wdevices.cpp129 > Error111error C2065: 'GET_LENGTH_INFORMATION' : undeclared > identifierf:\DFF\dff-1.1.0\modules\connector\devices\wdevices.cpp132 > Error112error C2146: syntax error : missing ';' before identifier > 'diskSize'f:\DFF\dff-1.1.0\modules\connector\devices\wdevices.cpp132 > Error113error C2065: 'diskSize' : undeclared > identifierf:\DFF\dff-1.1.0\modules\connector\devices\wdevices.cpp132 > Error114error C2065: 'IOCTL_DISK_GET_LENGTH_INFO' : undeclared > identifierf:\DFF\dff-1.1.0\modules\connector\devices\wdevices.cpp133 > Error115error C2070: ''unknown-type'': illegal sizeof > operandf:\DFF\dff-1.1.0\modules\connector\devices\wdevices.cpp133 > Error116error C2228: left of '.Length' must have > class/struct/unionf:\DFF\dff-1.1.0\modules\connector\devices\wdevices.cpp134 > Error117error C2228: left of '.QuadPart' must have > class/struct/unionf:\DFF\dff-1.1.0\modules\connector\devices\wdevices.cpp134 > Error139fatal error C1083: Cannot open include file: 'afflib/afflib.h': No such > file or directoryf:\dff\dff-1.1.0\modules\connector\aff\aff.hpp34 > Error140fatal error C1083: Cannot open include file: 'afflib/afflib.h': No such > file or directoryf:\dff\dff-1.1.0\modules\connector\aff\aff.hpp34 > Error141fatal error C1083: Cannot open include file: 'afflib/afflib.h': No such > file or directoryf:\dff\dff-1.1.0\modules\connector\aff\aff.hpp34 > > -- > > =================================================== > > *SiHyeon(Hans) Yang.* > > Chaple the Customizing Blue IceCream > > ChapleLab > > Email) c hapletci at gmail.com > > Blog ) www.ctciblog.net > > > > ==================================================== > > > > > _______________________________________________ > dff-devel mailing list > dff-devel at digital-forensic.org > http://lists.digital-forensic.org/listinfo/dff-devel -- Fr?d?ric Baguelin frederic.baguelin at arxsys.fr ArxSys SAS, Directeur technique T?l: +33 146 362 522 From fba at arxsys.fr Mon Jun 6 13:18:43 2011 From: fba at arxsys.fr (=?UTF-8?B?RnLDqWTDqXJpYyBCYWd1ZWxpbg==?=) Date: Mon, 06 Jun 2011 11:18:43 +0000 Subject: [dff-devel] Problem during translation work...(resend) In-Reply-To: References: Message-ID: <4DECB793.9020106@arxsys.fr> Hi, in fact, some files are missing in source packages to be able to compile the framework on Windows. Currently, if you don't need afflib and libpff, you can do the following: in modules/connector/CMakeLists.txt comment (with #) the following lines: if(WIN32 OR AFF_LIBRARY) add_subdirectory(aff) endif(WIN32 OR AFF_LIBRARY) in modules/CMakeLists.txt comment: add_subdirectory (mailbox) If you really need to compile with these dependencies, Christophe (he is the packager) could explain you how to do it yourself. Regards, On 06/02/11 04:10, Yang SiHyeon wrote: > Hi. this is SiHyeon Yang (Hans) > > During my translation work of this DFF to Korean, > > I am using 1.1.0 version of DFF source to test my Korean translation. > > When I build release version in Visual Studio 2005 for Windows compilation, > > I am suffering a lot of error and I think zip type of source file is missing > some files like "libpff.h", "afflilb.h", and etc. > > like attached error list from Visual Studio 2005. > > So, I tried to use tarball type of source code which is not working on my > computer > > When I check md5, zip type is ok but tarball type is wrong. > > My dff-src-1.1.0.tar.gz's md5 is below. > > 5c1456db63dba6514c8642ac12182346 *dff-src-1.1.0.tar.gz > > I downloaded and did md5 it twice. > > Help me to solve all these errors and problems to test my translation work. > > Have a good day... > > Error 22 error C2065: 'GET_LENGTH_INFORMATION' : undeclared identifier > f:\DFF\dff-1.1.0\api\devices\wmidev.cpp 91 > Error 23 error C2146: syntax error : missing ';' before identifier > 'diskSize' f:\DFF\dff-1.1.0\api\devices\wmidev.cpp 91 > Error 24 error C2065: 'diskSize' : undeclared identifier > f:\DFF\dff-1.1.0\api\devices\wmidev.cpp 91 > Error 25 error C2065: 'FSCTL_ALLOW_EXTENDED_DASD_IO' : undeclared identifier > f:\DFF\dff-1.1.0\api\devices\wmidev.cpp 93 > Error 26 error C2065: 'IOCTL_DISK_GET_LENGTH_INFO' : undeclared identifier > f:\DFF\dff-1.1.0\api\devices\wmidev.cpp 94 > Error 27 error C2070: ''unknown-type'': illegal sizeof operand > f:\DFF\dff-1.1.0\api\devices\wmidev.cpp 94 > Error 28 error C2228: left of '.Length' must have class/struct/union > f:\DFF\dff-1.1.0\api\devices\wmidev.cpp 97 > Error 29 error C2228: left of '.QuadPart' must have class/struct/union > f:\DFF\dff-1.1.0\api\devices\wmidev.cpp 97 > Error 30 error C3861: 'CoInitializeEx': identifier not found > f:\DFF\dff-1.1.0\api\devices\wmidev.cpp 114 > Error 31 error C2065: 'EOAC_NONE' : undeclared identifier > f:\DFF\dff-1.1.0\api\devices\wmidev.cpp 121 > Error 32 error C3861: 'CoInitializeSecurity': identifier not found > f:\DFF\dff-1.1.0\api\devices\wmidev.cpp 120 > Error 33 error C3861: 'CoSetProxyBlanket': identifier not found > f:\DFF\dff-1.1.0\api\devices\wmidev.cpp 141 > Error 50 fatal error C1083: Cannot open include file: 'libpff.h': No such > file or directory f:\dff\dff-1.1.0\modules\mailbox\pff\pff_common.hpp 26 > Error 51 fatal error C1083: Cannot open include file: 'libpff.h': No such > file or directory f:\dff\dff-1.1.0\modules\mailbox\pff\pff_common.hpp 26 > Error 52 fatal error C1083: Cannot open include file: 'libpff.h': No such > file or directory f:\dff\dff-1.1.0\modules\mailbox\pff\pff_common.hpp 26 > Error 53 fatal error C1083: Cannot open include file: 'libpff.h': No such > file or directory f:\dff\dff-1.1.0\modules\mailbox\pff\pff_common.hpp 26 > Error 54 fatal error C1083: Cannot open include file: 'libpff.h': No such > file or directory f:\dff\dff-1.1.0\modules\mailbox\pff\pff_common.hpp 26 > Error 55 fatal error C1083: Cannot open include file: 'libpff.h': No such > file or directory f:\dff\dff-1.1.0\modules\mailbox\pff\pff_common.hpp 26 > Error 56 fatal error C1083: Cannot open include file: 'libpff.h': No such > file or directory f:\dff\dff-1.1.0\modules\mailbox\pff\pff_common.hpp 26 > Error 57 fatal error C1083: Cannot open include file: 'libpff.h': No such > file or directory f:\dff\dff-1.1.0\modules\mailbox\pff\pff_common.hpp 26 > Error 58 fatal error C1083: Cannot open include file: 'libpff.h': No such > file or directory f:\dff\dff-1.1.0\modules\mailbox\pff\pff_common.hpp 26 > Error 61 fatal error C1083: Cannot open include file: 'libpff.h': No such > file or directory f:\dff\dff-1.1.0\modules\mailbox\pff\pff_common.hpp 26 > Error 62 fatal error C1083: Cannot open include file: 'libpff.h': No such > file or directory f:\dff\dff-1.1.0\modules\mailbox\pff\pff_common.hpp 26 > Error 63 fatal error C1083: Cannot open include file: 'libpff.h': No such > file or directory f:\dff\dff-1.1.0\modules\mailbox\pff\pff_common.hpp 26 > Error 64 fatal error C1083: Cannot open include file: 'libpff.h': No such > file or directory f:\dff\dff-1.1.0\modules\mailbox\pff\pff_common.hpp 26 > Error 65 fatal error C1083: Cannot open include file: 'libpff.h': No such > file or directory f:\dff\dff-1.1.0\modules\mailbox\pff\pff_common.hpp 26 > Error 66 fatal error C1083: Cannot open include file: 'libpff.h': No such > file or directory f:\dff\dff-1.1.0\modules\mailbox\pff\pff_common.hpp 26 > Error 67 fatal error C1083: Cannot open include file: 'libpff.h': No such > file or directory f:\dff\dff-1.1.0\modules\mailbox\pff\pff_common.hpp 26 > Error 110 error C2065: 'FSCTL_ALLOW_EXTENDED_DASD_IO' : undeclared > identifier f:\DFF\dff-1.1.0\modules\connector\devices\wdevices.cpp 129 > Error 111 error C2065: 'GET_LENGTH_INFORMATION' : undeclared identifier > f:\DFF\dff-1.1.0\modules\connector\devices\wdevices.cpp 132 > Error 112 error C2146: syntax error : missing ';' before identifier > 'diskSize' f:\DFF\dff-1.1.0\modules\connector\devices\wdevices.cpp 132 > Error 113 error C2065: 'diskSize' : undeclared identifier > f:\DFF\dff-1.1.0\modules\connector\devices\wdevices.cpp 132 > Error 114 error C2065: 'IOCTL_DISK_GET_LENGTH_INFO' : undeclared identifier > f:\DFF\dff-1.1.0\modules\connector\devices\wdevices.cpp 133 > Error 115 error C2070: ''unknown-type'': illegal sizeof operand > f:\DFF\dff-1.1.0\modules\connector\devices\wdevices.cpp 133 > Error 116 error C2228: left of '.Length' must have class/struct/union > f:\DFF\dff-1.1.0\modules\connector\devices\wdevices.cpp 134 > Error 117 error C2228: left of '.QuadPart' must have class/struct/union > f:\DFF\dff-1.1.0\modules\connector\devices\wdevices.cpp 134 > Error 139 fatal error C1083: Cannot open include file: 'afflib/afflib.h': No > such file or directory f:\dff\dff-1.1.0\modules\connector\aff\aff.hpp 34 > Error 140 fatal error C1083: Cannot open include file: 'afflib/afflib.h': No > such file or directory f:\dff\dff-1.1.0\modules\connector\aff\aff.hpp 34 > Error 141 fatal error C1083: Cannot open include file: 'afflib/afflib.h': No > such file or directory f:\dff\dff-1.1.0\modules\connector\aff\aff.hpp 34 > > > > > _______________________________________________ > dff-devel mailing list > dff-devel at digital-forensic.org > http://lists.digital-forensic.org/listinfo/dff-devel -- Fr?d?ric Baguelin frederic.baguelin at arxsys.fr ArxSys SAS, Directeur technique T?l: +33 146 362 522 From tim-forensics at sentinelchicken.org Tue Jun 21 05:55:49 2011 From: tim-forensics at sentinelchicken.org (Timothy D. Morgan) Date: Mon, 20 Jun 2011 20:55:49 -0700 Subject: [dff-devel] Suggestion: consider using pyregfi Message-ID: <20110621035549.GU1542@sentinelchicken.org> Hello everyone, I'm the developer of RegLookup[1]. I recently released a major update which provides a Python API to much of RegLookup's functionality. I feel the project has become pretty stable and is well documented. Over the last several years, I've run into probably a dozen different people working in forensics who have written their own registry parsers. The basics aren't hard to do, once you have a spec to go against, but I find that few open source implementations do a *good* job at getting all of the structures reliably interpreted. I don't see a reason why we need so many different implementations of open source registry tools, particularly when many of them use the same languages and the same licenses (I can think of 2 others that are in Python). My hope is that the DFF developers will take a look at pyregfi[2] and try to determine if it could be integrated into the project. I haven't looked much at the current DFF implementation, but I believe DFF would benefit in at least the following ways: A. C-based implementation which will likely be faster and more scalable. B. The addition of Big Data ("bd") records, which I don't believe DFF supports yet. C. Reduced code to maintain (since I'll be continuing to support pyregfi). Let me know if you have any questions about how RegLookup/regfi/pyregfi is put together. I'm also open to hearing ideas on how to improve the API if there is anything you would need out of it. Best regards, tim P.S. From a dependency standpoint, a RegLookup package is maintained by the Debian forensics team and I also cross-compile binaries for win32, so hopefully it wouldn't introduce any issues there. 1. http://projects.sentinelchicken.org/reglookup/ 2. http://projects.sentinelchicken.org/data/doc/reglookup/pyregfi/ From fba at arxsys.fr Tue Jun 21 12:48:44 2011 From: fba at arxsys.fr (=?ISO-8859-1?Q?Fr=E9d=E9ric_Baguelin?=) Date: Tue, 21 Jun 2011 10:48:44 +0000 Subject: [dff-devel] Suggestion: consider using pyregfi In-Reply-To: <20110621035549.GU1542@sentinelchicken.org> References: <20110621035549.GU1542@sentinelchicken.org> Message-ID: <4E00770C.4070403@arxsys.fr> On 06/21/11 03:55, Timothy D. Morgan wrote: > > Hello everyone, > Hi, > I'm the developer of RegLookup[1]. I recently released a major update > which provides a Python API to much of RegLookup's functionality. I > feel the project has become pretty stable and is well documented. > > Over the last several years, I've run into probably a dozen different > people working in forensics who have written their own registry > parsers. The basics aren't hard to do, once you have a spec to go > against, but I find that few open source implementations do a *good* > job at getting all of the structures reliably interpreted. I don't > see a reason why we need so many different implementations of open > source registry tools, particularly when many of them use the same > languages and the same licenses (I can think of 2 others that are in > Python). > I totally agree ! Focusing on one tool will provide better features. > My hope is that the DFF developers will take a look at pyregfi[2] and > try to determine if it could be integrated into the project. I > haven't looked much at the current DFF implementation, but I believe > DFF would benefit in at least the following ways: > We gonna have a look to your project. At first glance, your API seems interesting. :) > A. C-based implementation which will likely be faster and more scalable. > The current one in DFF is Python only. So, it would be great to have a C-based implementation. > B. The addition of Big Data ("bd") records, which I don't believe DFF > supports yet. > I'm not in charge of the development of the registry module of DFF but Jeremy, who is in charge of it, just told me he manages Big Data. By the way, do you manage unallocated space ? Jeremy has based its implementation on Jolanta Thomassen's thesis [1]. He also has started to rewrite the module to provide something which seems similar to your work. > C. Reduced code to maintain (since I'll be continuing to support > pyregfi). > > > Let me know if you have any questions about how > RegLookup/regfi/pyregfi is put together. I'm also open to hearing > ideas on how to improve the API if there is anything you would need > out of it. > We will come back to you after the core team of DFF will discuss about this possibility. > Best regards, > tim > Kind regards, [1] http://sentinelchicken.com/data/JolantaThomassenDISSERTATION.pdf > > P.S. From a dependency standpoint, a RegLookup package is maintained > by the Debian forensics team and I also cross-compile binaries for > win32, so hopefully it wouldn't introduce any issues there. > > > 1. http://projects.sentinelchicken.org/reglookup/ > > 2. http://projects.sentinelchicken.org/data/doc/reglookup/pyregfi/ > _______________________________________________ > dff-devel mailing list > dff-devel at digital-forensic.org > http://lists.digital-forensic.org/listinfo/dff-devel -- Fr?d?ric Baguelin frederic.baguelin at arxsys.fr ArxSys SAS, Directeur technique T?l: +33 146 362 522 From jeremy.mounier at arxsys.fr Tue Jun 21 11:05:02 2011 From: jeremy.mounier at arxsys.fr (=?ISO-8859-1?Q?J=E9r=E9my_Mounier?=) Date: Tue, 21 Jun 2011 11:05:02 +0200 Subject: [dff-devel] Suggestion: consider using pyregfi In-Reply-To: <20110621035549.GU1542@sentinelchicken.org> References: <20110621035549.GU1542@sentinelchicken.org> Message-ID: <4E005EBE.6060505@arxsys.fr> Hello Tim, I developed the DFF's Registry module and recently planned to improve it. Like Frederic said, I coded IT from Jolanta Thomassen's thesis but I didn't had time to implement all functions I wanted. I just look at your work and It seems very interesting, with more functions that our module (and more reusable code ;) ). We will have a look at how to implement it into DFF. Don't hesitate to connect to our IRC channel in order to discuss about your work or mine. It will be a real pleasure. Regards, J?r?my On 06/21/2011 05:55 AM, Timothy D. Morgan wrote: > Hello everyone, > > I'm the developer of RegLookup[1]. I recently released a major update > which provides a Python API to much of RegLookup's functionality. I > feel the project has become pretty stable and is well documented. > > Over the last several years, I've run into probably a dozen different > people working in forensics who have written their own registry > parsers. The basics aren't hard to do, once you have a spec to go > against, but I find that few open source implementations do a *good* > job at getting all of the structures reliably interpreted. I don't > see a reason why we need so many different implementations of open > source registry tools, particularly when many of them use the same > languages and the same licenses (I can think of 2 others that are in > Python). > > My hope is that the DFF developers will take a look at pyregfi[2] and > try to determine if it could be integrated into the project. I > haven't looked much at the current DFF implementation, but I believe > DFF would benefit in at least the following ways: > > A. C-based implementation which will likely be faster and more scalable. > > B. The addition of Big Data ("bd") records, which I don't believe DFF > supports yet. > > C. Reduced code to maintain (since I'll be continuing to support > pyregfi). > > > Let me know if you have any questions about how > RegLookup/regfi/pyregfi is put together. I'm also open to hearing > ideas on how to improve the API if there is anything you would need > out of it. > > Best regards, > tim > > > P.S. From a dependency standpoint, a RegLookup package is maintained > by the Debian forensics team and I also cross-compile binaries for > win32, so hopefully it wouldn't introduce any issues there. > > > 1. http://projects.sentinelchicken.org/reglookup/ > > 2. http://projects.sentinelchicken.org/data/doc/reglookup/pyregfi/ > _______________________________________________ > dff-devel mailing list > dff-devel at digital-forensic.org > http://lists.digital-forensic.org/listinfo/dff-devel -- J?r?my Mounier Dirigeant associ? Soci?t? ArxSys, 14 rue Soleillet 75020 PARIS Tel : +33(0) 146 362 522 www.arxsys.fr From tim-forensics at sentinelchicken.org Tue Jun 21 16:26:16 2011 From: tim-forensics at sentinelchicken.org (Tim) Date: Tue, 21 Jun 2011 07:26:16 -0700 Subject: [dff-devel] Suggestion: consider using pyregfi In-Reply-To: <4E005EBE.6060505@arxsys.fr> References: <20110621035549.GU1542@sentinelchicken.org> <4E005EBE.6060505@arxsys.fr> Message-ID: <20110621142616.GW1542@sentinelchicken.org> Hi Jeremy, > I developed the DFF's Registry module and recently planned to improve it. > > Like Frederic said, I coded IT from Jolanta Thomassen's thesis but I > didn't had time to implement all functions I wanted. I just look at > your work and It seems very interesting, with more functions that > our module (and more reusable code ;) ). Great. I had some good chats with Jolanta back at DFRWS 2008. As it turns out she and I were doing the same research on deleted structure recovery that year, and it was great to talk to someone who independently came to many of the same conclusions. > We will have a look at how to implement it into DFF. Don't hesitate > to connect to our IRC channel in order to discuss about your work or > mine. It will be a real pleasure. Will do! Talk to you soon. tim From tim-forensics at sentinelchicken.org Tue Jun 21 16:34:55 2011 From: tim-forensics at sentinelchicken.org (Tim) Date: Tue, 21 Jun 2011 07:34:55 -0700 Subject: [dff-devel] Suggestion: consider using pyregfi In-Reply-To: <4E00770C.4070403@arxsys.fr> References: <20110621035549.GU1542@sentinelchicken.org> <4E00770C.4070403@arxsys.fr> Message-ID: <20110621143455.GX1542@sentinelchicken.org> Hi Frederic, > >I'm the developer of RegLookup[1]. I recently released a major update > >which provides a Python API to much of RegLookup's functionality. I > >feel the project has become pretty stable and is well documented. > > > >Over the last several years, I've run into probably a dozen different > >people working in forensics who have written their own registry > >parsers. The basics aren't hard to do, once you have a spec to go > >against, but I find that few open source implementations do a *good* > >job at getting all of the structures reliably interpreted. I don't > >see a reason why we need so many different implementations of open > >source registry tools, particularly when many of them use the same > >languages and the same licenses (I can think of 2 others that are in > >Python). > > > > I totally agree ! Focusing on one tool will provide better features. That's my hope. There are a number of unknowns still in the registry format, and it would love to team up with some other interested folks to do the necessary research on them. Working together on the same code base could free up some time somewhere along the line to tackle those things. > I'm not in charge of the development of the registry module of DFF > but Jeremy, who is in charge of it, just told me he manages Big > Data. Oh, ok, I must have missed that. > By the way, do you manage unallocated space ? Yes, I believe RegLookup was the first published tool to recover deleted structures. You can read about the research in [1] and [2]. Jolanta was doing this research separately at the same time, and I barely beat her to the punch on it. The data recovery algorithms currently exist in the reglookup-recover command line tool and are not yet integrated into (py)regfi. Somewhat surprisingly, there doesn't seem to be a lot of demand for this kind of recovery, and I wanted to prioritize the main feature set in getting regfi and pyregfi stabilized. I do intend to merge these algorithms into regfi over time to support recovery from whole registries as well as from registry fragments. I just haven't had the time to work out the best interface for that. Thanks much for your quick response guys. I'll hop on IRC now. ;-) tim 1. http://www.dfrws.org/2008/proceedings/p33-morgan.pdf 2. http://www.dfrws.org/2008/proceedings/p33-morgan_pres.pdf From chapletci at gmail.com Thu Jun 2 05:41:30 2011 From: chapletci at gmail.com (Yang SiHyeon) Date: Thu, 02 Jun 2011 03:41:30 -0000 Subject: [dff-devel] Problem of translation work Message-ID: Hi. this is SiHyeon Yang (Hans) During my translation work of this DFF to Korean, I am using 1.1.0 version of DFF source to test my Korean translation. When I build release version in Visual Studio 2005 for Windows compilation, I am suffering a lot of error and I think zip type of source file is missing some files like "libpff.h", "afflilb.h", and etc. like attached image of error list from Visual Studio 2005. So, I tried to use tarball type of source code which is not working on my computer When I check md5, zip type is ok but tarball type is wrong. My dff-src-1.1.0.tar.gz's md5 is below. 5c1456db63dba6514c8642ac12182346 *dff-src-1.1.0.tar.gz I downloaded and did md5 it twice. Help me to solve all these errors and problems to test my translation work. Have a good day... -- =================================================== *SiHyeon(Hans) Yang.* Chaple the Customizing Blue IceCream ChapleLab Email) c hapletci at gmail.com Blog ) www.ctciblog.net ==================================================== -------------- next part -------------- An HTML attachment was scrubbed... URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: errorlist.png Type: image/png Size: 70858 bytes Desc: not available URL: