From gareth at amigahistory.plus.com Wed Jul 6 14:53:23 2011 From: gareth at amigahistory.plus.com (Gareth Knight) Date: Wed, 06 Jul 2011 13:53:23 +0100 Subject: [dff] Using DFF with 3rd party carving tools Message-ID: <4E145AC3.3090704@amigahistory.plus.com> Hello all, I've been testing the functionality of DFF with the intent of using it within a teaching environment. However, I've noticed that the carving functionality is quite slow and limited in comparison to other tools. Are there plans to integrate other carving tools, such as Scalpel, or enable the user to configure PhotoRec or similar using command line parameters? Thanks, Gareth From solal.jacob at ArxSys.fr Thu Jul 7 16:23:06 2011 From: solal.jacob at ArxSys.fr (Solal Jacob) Date: Thu, 07 Jul 2011 14:23:06 +0000 Subject: [dff] Using DFF with 3rd party carving tools In-Reply-To: <4E145AC3.3090704@amigahistory.plus.com> References: <4E145AC3.3090704@amigahistory.plus.com> Message-ID: <4E15C14A.6050208@ArxSys.fr> Hello Gareth, There is no plan to integrate Scalpel or Photorec in DFF yet. DFF 1.2 will come soon with all the find/search functionality totally rewritten and they are excepted too be speeder. The carver is planned to be rewritten with this new functionality in DFF 1.3 . Regards, Solal. On 07/06/11 12:53, Gareth Knight wrote: > Hello all, > I've been testing the functionality of DFF with the intent of using it > within a teaching environment. However, I've noticed that the carving > functionality is quite slow and limited in comparison to other tools. > Are there plans to integrate other carving tools, such as Scalpel, or > enable the user to configure PhotoRec or similar using command line > parameters? > > Thanks, > Gareth > _______________________________________________ > dff mailing list > dff at digital-forensic.org > http://lists.digital-forensic.org/listinfo/dff -- Solal Jacob solal.jacob at arxsys.fr ArxSys, Riposte Num?rique 14-16, Rue du Soleillet 75020 Paris T?l: +33 1 46 36 25 22 www.arxsys.fr www.digital-forensic.org From m77 at libero.it Wed Jul 13 13:18:54 2011 From: m77 at libero.it (M77) Date: Wed, 13 Jul 2011 13:18:54 +0200 Subject: [dff] Problem compiling DFF 1.1.0 on FreeBSD Message-ID: <4E1D7F1E.2090407@libero.it> Hi to all, I'm new to DFF and usually I work on FreeBSD or Win. When compiling DFF 1.1.0 on FreeBSD I get this error: [ 98%] Building CXX object modules/connector/fuse/CMakeFiles/_FUSE.dir/fusePYTHON_wrap.cxx.o In file included from /usr/home/m77/Downloads/dff-1.1.0/modules/connector/fuse/fusePYTHON_wrap.cxx:3656: /usr/home/m77/Downloads/dff-1.1.0/modules/connector/fuse/fuse.hpp:34:18: error: fuse.h: No such file or directory *** Error code 1 Stop in /usr/home/m77/Downloads/dff-1.1.0. *** Error code 1 Stop in /usr/home/m77/Downloads/dff-1.1.0. *** Error code 1 Stop in /usr/home/m77/Downloads/dff-1.1.0. Compile commands that I use are: $cmake -DINSTALL=TRUE $make on FreeBSD 8.2 i386 with custom kernel I've checked, and fuse.hpp is present in his dir... Have hints to solve? Thanks m1001101 -------------- next part -------------- An HTML attachment was scrubbed... URL: From solal.jacob at ArxSys.fr Wed Jul 13 15:23:19 2011 From: solal.jacob at ArxSys.fr (Solal Jacob) Date: Wed, 13 Jul 2011 13:23:19 +0000 Subject: [dff] Problem compiling DFF 1.1.0 on FreeBSD In-Reply-To: <4E1D7F1E.2090407@libero.it> References: <4E1D7F1E.2090407@libero.it> Message-ID: <4E1D9C47.7080806@ArxSys.fr> Hello, We didn't have tested to compile DFF on FreeBSD for quite a long time, but it should work at least with minor change. Concerning, your error, it deal with fuse.h in your include directory (usually /usr/include) not DFF fuse.hpp, you certainly didn't have installed the fuse library . However this error shouldn't happen, as we check in the principal CMakeLists, if fuse is installed and if not, we avoid to compile the module. But this was certainly not tested under FreeBSD. If you install fuse and still get the error you could edit the CMakeLists.txt in modules/connector/ and comment lines like this : #if(HAVE_FUSE) # add_subdirectory (fuse) #endif(HAVE_FUSE) This will avoid the compilation of the FUSE module, who is not mandatory. We're interested on the behaviour of DFF under FreeBSD so don't hesitate to made us some feedback. Thanks Solal. On 07/13/11 11:18, M77 wrote: > Hi to all, I'm new to DFF and usually I work on FreeBSD or Win. > When compiling DFF 1.1.0 on FreeBSD I get this error: > > [ 98%] Building CXX object > modules/connector/fuse/CMakeFiles/_FUSE.dir/fusePYTHON_wrap.cxx.o > In file included from > /usr/home/m77/Downloads/dff-1.1.0/modules/connector/fuse/fusePYTHON_wrap.cxx:3656: > /usr/home/m77/Downloads/dff-1.1.0/modules/connector/fuse/fuse.hpp:34:18: > error: fuse.h: No such file or directory > *** Error code 1 > > Stop in /usr/home/m77/Downloads/dff-1.1.0. > *** Error code 1 > > Stop in /usr/home/m77/Downloads/dff-1.1.0. > *** Error code 1 > > Stop in /usr/home/m77/Downloads/dff-1.1.0. > > Compile commands that I use are: > > $cmake -DINSTALL=TRUE > $make > > on FreeBSD 8.2 i386 with custom kernel > > I've checked, and fuse.hpp is present in his dir... > > Have hints to solve? > > Thanks > > m1001101 > > > _______________________________________________ > dff mailing list > dff at digital-forensic.org > http://lists.digital-forensic.org/listinfo/dff > -- Solal Jacob solal.jacob at arxsys.fr ArxSys, Riposte Num?rique 14-16, Rue du Soleillet 75020 Paris T?l: +33 1 46 36 25 22 www.arxsys.fr www.digital-forensic.org -------------- next part -------------- An HTML attachment was scrubbed... URL: From m77 at libero.it Wed Jul 13 14:34:21 2011 From: m77 at libero.it (M77) Date: Wed, 13 Jul 2011 14:34:21 +0200 Subject: [dff] Problem compiling DFF 1.1.0 on FreeBSD In-Reply-To: <4E1D9C47.7080806@ArxSys.fr> References: <4E1D7F1E.2090407@libero.it> <4E1D9C47.7080806@ArxSys.fr> Message-ID: <4E1D90CD.4040300@libero.it> Thanks, now compile process reach completion without errors, and so installation. I've commented fuse lines in CMakeLists.txt and checked the installed version of fuse libs: Information for fusefs-libs-2.7.4: ...but when launch dff or dff -g Traceback (most recent call last): File "/usr/local/lib/python2.6/site-packages/dff/dff.py", line 30, in from api.manager.manager import ApiManager File "/usr/local/lib/python2.6/site-packages/dff/api/manager/manager.py", line 27, in from api.datatype.magichandler import MagicHandler File "/usr/local/lib/python2.6/site-packages/dff/api/datatype/magichandler.py", line 20, in import magic ImportError: No module named magic I've checked these paths and files are present. I think the problem is python installation... Il 13.07.2011 15:23, Solal Jacob ha scritto: > Hello, > > We didn't have tested to compile DFF on FreeBSD for quite a long > time, but it should work at least with minor change. > > Concerning, your error, it deal with fuse.h in your include directory > (usually /usr/include) not DFF fuse.hpp, > you certainly didn't have installed the fuse library . > However this error shouldn't happen, as we check in the principal > CMakeLists, if fuse is installed and if not, we avoid to compile the > module. > But this was certainly not tested under FreeBSD. > If you install fuse and still get the error you could edit the > CMakeLists.txt in modules/connector/ > and comment lines like this : > > #if(HAVE_FUSE) > # add_subdirectory (fuse) > #endif(HAVE_FUSE) > > This will avoid the compilation of the FUSE module, who is not > mandatory. > We're interested on the behaviour of DFF under FreeBSD so don't > hesitate to made us some feedback. > > > Thanks > > > > Solal. > > > On 07/13/11 11:18, M77 wrote: >> Hi to all, I'm new to DFF and usually I work on FreeBSD or Win. >> When compiling DFF 1.1.0 on FreeBSD I get this error: >> >> [ 98%] Building CXX object >> modules/connector/fuse/CMakeFiles/_FUSE.dir/fusePYTHON_wrap.cxx.o >> In file included from >> /usr/home/m77/Downloads/dff-1.1.0/modules/connector/fuse/fusePYTHON_wrap.cxx:3656: >> /usr/home/m77/Downloads/dff-1.1.0/modules/connector/fuse/fuse.hpp:34:18: >> error: fuse.h: No such file or directory >> *** Error code 1 >> >> Stop in /usr/home/m77/Downloads/dff-1.1.0. >> *** Error code 1 >> >> Stop in /usr/home/m77/Downloads/dff-1.1.0. >> *** Error code 1 >> >> Stop in /usr/home/m77/Downloads/dff-1.1.0. >> >> Compile commands that I use are: >> >> $cmake -DINSTALL=TRUE >> $make >> >> on FreeBSD 8.2 i386 with custom kernel >> >> I've checked, and fuse.hpp is present in his dir... >> >> Have hints to solve? >> >> Thanks >> >> m1001101 >> >> >> _______________________________________________ >> dff mailing list >> dff at digital-forensic.org >> http://lists.digital-forensic.org/listinfo/dff >> > > > -- > Solal Jacob solal.jacob at arxsys.fr > ArxSys, Riposte Num?rique > 14-16, Rue du Soleillet 75020 Paris > T?l: +33 1 46 36 25 22 > www.arxsys.fr www.digital-forensic.org > > > _______________________________________________ > dff mailing list > dff at digital-forensic.org > http://lists.digital-forensic.org/listinfo/dff -------------- next part -------------- An HTML attachment was scrubbed... URL: From christophe.malinge at arxsys.fr Wed Jul 13 15:04:14 2011 From: christophe.malinge at arxsys.fr (Christophe Malinge) Date: Wed, 13 Jul 2011 15:04:14 +0200 Subject: [dff] Problem compiling DFF 1.1.0 on FreeBSD In-Reply-To: <4E1D90CD.4040300@libero.it> References: <4E1D7F1E.2090407@libero.it> <4E1D9C47.7080806@ArxSys.fr> <4E1D90CD.4040300@libero.it> Message-ID: <4E1D97CE.4020801@arxsys.fr> Hello, I have an outdated FreeBSD 8.1, with fuse : # pkg_info | grep -i fuse fusefs-libs-2.7.4 FUSE allows filesystem implementation in userspace But unfortunately I'm unable to launch it, PyQt and Qt versions are in conflict, I have to fix it first first. On 07/13/11 14:34, M77 wrote: > Thanks, now compile process reach completion without errors, and so installation. > I've commented fuse lines in CMakeLists.txt and checked the installed version of fuse libs: > > Information for fusefs-libs-2.7.4: > > ...but when launch dff or dff -g > > Traceback (most recent call last): > File "/usr/local/lib/python2.6/site-packages/dff/dff.py", line 30, in > from api.manager.manager import ApiManager > File "/usr/local/lib/python2.6/site-packages/dff/api/manager/manager.py", line 27, in > from api.datatype.magichandler import MagicHandler > File "/usr/local/lib/python2.6/site-packages/dff/api/datatype/magichandler.py", line 20, in > import magic > ImportError: No module named magic Do you have python-magic ? On my 8.1 install it works (except the Qt version conflict ;) ) : # pkg_info | grep -i 'py.*magic' py26-magic-5.04 Python module for determing file type > > I've checked these paths and files are present. > > I think the problem is python installation... I think so ! > > > Il 13.07.2011 15:23, Solal Jacob ha scritto: >> >> #if(HAVE_FUSE) >> # add_subdirectory (fuse) >> #endif(HAVE_FUSE) Better way is to override detection like it : $ cmake -DINSTALL=YES -DHAVE_FUSE=NO Delete CMakeCache.txt and cmake again if cmake don't says "-- (Optionnal) fuse library not found; file system module 'fuse' will not be built". Just in case you really want to test fuse (has never been tested on FreeBSD ...) you should apply the attached patch I just made ; 0001-Removes-hardcoded-fuse-header_Detect-it.patch It removes ugly hardcoded fuse.h path in modules/connector/fuse/CMakeLists.txt and extends fuse detection in top level CMakeLists.txt. Hope it helps, Christophe. -- Christophe Malinge DFF, Core developer, System administrator ArxSys SAS, Directeur des syst?mes d'information T?l: +33 1 46 36 25 22 Fax: +33 9 55 52 90 57 -------------- next part -------------- An embedded and charset-unspecified text was scrubbed... Name: 0001-Removes-hardcoded-fuse-header_Detect-it.patch URL: From m77 at libero.it Wed Jul 13 17:17:10 2011 From: m77 at libero.it (M77) Date: Wed, 13 Jul 2011 17:17:10 +0200 Subject: [dff] Problem executing DFF on FreeBSD Message-ID: <4E1DB6F6.1090404@libero.it> Ok, now I've installed py-magic port from /usr/local/devel/py-magic this solvet the first import error. now the errors is: Traceback (most recent call last): File "/usr/local/lib/python2.6/site-packages/dff/dff.py", line 31, in from ui.ui import ui, usage File "/usr/local/lib/python2.6/site-packages/dff/ui/ui.py", line 21, in from gui.gui import * File "/usr/local/lib/python2.6/site-packages/dff/ui/gui/gui.py", line 21, in from mainwindow import MainWindow File "/usr/local/lib/python2.6/site-packages/dff/ui/gui/mainwindow.py", line 52, in from ui.gui.widget.help import Help File "/usr/local/lib/python2.6/site-packages/dff/ui/gui/widget/help.py", line 21, in from PyQt4.QtHelp import QHelpEngine ImportError: No module named QtHelp need check presence of these modules in my system... From m77 at libero.it Wed Jul 13 17:18:43 2011 From: m77 at libero.it (M77) Date: Wed, 13 Jul 2011 17:18:43 +0200 Subject: [dff] Problem compiling DFF 1.1.0 on FreeBSD Message-ID: <4E1DB753.3050604@libero.it> missed message :p -------- Messaggio originale -------- Oggetto: Re: [dff] Problem compiling DFF 1.1.0 on FreeBSD Data: Wed, 13 Jul 2011 14:34:21 +0200 Mittente: M77 A: Solal Jacob CC: dff at digital-forensic.org Thanks, now compile process reach completion without errors, and so installation. I've commented fuse lines in CMakeLists.txt and checked the installed version of fuse libs: Information for fusefs-libs-2.7.4: ...but when launch dff or dff -g Traceback (most recent call last): File "/usr/local/lib/python2.6/site-packages/dff/dff.py", line 30, in from api.manager.manager import ApiManager File "/usr/local/lib/python2.6/site-packages/dff/api/manager/manager.py", line 27, in from api.datatype.magichandler import MagicHandler File "/usr/local/lib/python2.6/site-packages/dff/api/datatype/magichandler.py", line 20, in import magic ImportError: No module named magic I've checked these paths and files are present. I think the problem is python installation... Il 13.07.2011 15:23, Solal Jacob ha scritto: > Hello, > > We didn't have tested to compile DFF on FreeBSD for quite a long > time, but it should work at least with minor change. > > Concerning, your error, it deal with fuse.h in your include directory > (usually /usr/include) not DFF fuse.hpp, > you certainly didn't have installed the fuse library . > However this error shouldn't happen, as we check in the principal > CMakeLists, if fuse is installed and if not, we avoid to compile the > module. > But this was certainly not tested under FreeBSD. > If you install fuse and still get the error you could edit the > CMakeLists.txt in modules/connector/ > and comment lines like this : > > #if(HAVE_FUSE) > # add_subdirectory (fuse) > #endif(HAVE_FUSE) > > This will avoid the compilation of the FUSE module, who is not > mandatory. > We're interested on the behaviour of DFF under FreeBSD so don't > hesitate to made us some feedback. > > > Thanks > > > > Solal. > > > On 07/13/11 11:18, M77 wrote: >> Hi to all, I'm new to DFF and usually I work on FreeBSD or Win. >> When compiling DFF 1.1.0 on FreeBSD I get this error: >> >> [ 98%] Building CXX object >> modules/connector/fuse/CMakeFiles/_FUSE.dir/fusePYTHON_wrap.cxx.o >> In file included from >> /usr/home/m77/Downloads/dff-1.1.0/modules/connector/fuse/fusePYTHON_wrap.cxx:3656: >> /usr/home/m77/Downloads/dff-1.1.0/modules/connector/fuse/fuse.hpp:34:18: >> error: fuse.h: No such file or directory >> *** Error code 1 >> >> Stop in /usr/home/m77/Downloads/dff-1.1.0. >> *** Error code 1 >> >> Stop in /usr/home/m77/Downloads/dff-1.1.0. >> *** Error code 1 >> >> Stop in /usr/home/m77/Downloads/dff-1.1.0. >> >> Compile commands that I use are: >> >> $cmake -DINSTALL=TRUE >> $make >> >> on FreeBSD 8.2 i386 with custom kernel >> >> I've checked, and fuse.hpp is present in his dir... >> >> Have hints to solve? >> >> Thanks >> >> m1001101 >> >> >> _______________________________________________ >> dff mailing list >> dff at digital-forensic.org >> http://lists.digital-forensic.org/listinfo/dff >> > > > -- > Solal Jacob solal.jacob at arxsys.fr > ArxSys, Riposte Num?rique > 14-16, Rue du Soleillet 75020 Paris > T?l: +33 1 46 36 25 22 > www.arxsys.fr www.digital-forensic.org > > > _______________________________________________ > dff mailing list > dff at digital-forensic.org > http://lists.digital-forensic.org/listinfo/dff -------------- next part -------------- An HTML attachment was scrubbed... URL: From m77 at libero.it Wed Jul 13 19:01:00 2011 From: m77 at libero.it (M77) Date: Wed, 13 Jul 2011 19:01:00 +0200 Subject: [dff] Problem executing DFF on FreeBSD In-Reply-To: <4E1DB6F6.1090404@libero.it> References: <4E1DB6F6.1090404@libero.it> Message-ID: <4E1DCF4C.90208@libero.it> Updated all py-qt4 library, and now error is: Traceback (most recent call last): File "/usr/local/lib/python2.6/site-packages/dff/dff.py", line 31, in from ui.ui import ui, usage File "/usr/local/lib/python2.6/site-packages/dff/ui/ui.py", line 21, in from gui.gui import * File "/usr/local/lib/python2.6/site-packages/dff/ui/gui/gui.py", line 21, in from mainwindow import MainWindow File "/usr/local/lib/python2.6/site-packages/dff/ui/gui/mainwindow.py", line 32, in from api.gui.widget.nodebrowser import NodeBrowser File "/usr/local/lib/python2.6/site-packages/dff/api/gui/widget/nodebrowser.py", line 31, in from api.gui.dialog.extractor import Extractor File "/usr/local/lib/python2.6/site-packages/dff/api/gui/dialog/extractor.py", line 20, in from PyQt4.Qt import * File "/usr/local/lib/python2.6/site-packages/PyQt4/Qt.py", line 15, in from PyQt4.QtXmlPatterns import * RuntimeError: the PyQt4.QtCore module is version 0 but the PyQt4.QtXmlPatterns module requires version -1 Il 13.07.2011 17:17, M77 ha scritto: > Ok, now I've installed py-magic port from /usr/local/devel/py-magic > this solvet the first import error. > > now the errors is: > > Traceback (most recent call last): > File "/usr/local/lib/python2.6/site-packages/dff/dff.py", line 31, > in > from ui.ui import ui, usage > File "/usr/local/lib/python2.6/site-packages/dff/ui/ui.py", line 21, > in > from gui.gui import * > File "/usr/local/lib/python2.6/site-packages/dff/ui/gui/gui.py", > line 21, in > from mainwindow import MainWindow > File > "/usr/local/lib/python2.6/site-packages/dff/ui/gui/mainwindow.py", > line 52, in > from ui.gui.widget.help import Help > File > "/usr/local/lib/python2.6/site-packages/dff/ui/gui/widget/help.py", > line 21, in > from PyQt4.QtHelp import QHelpEngine > ImportError: No module named QtHelp > > > need check presence of these modules in my system... > > _______________________________________________ > dff mailing list > dff at digital-forensic.org > http://lists.digital-forensic.org/listinfo/dff > Return-Path: > Received: from mailrelay18.libero.it (192.168.32.138) by > ims4c2.libero.it (8.6.015.08) > id 4DF9D9EF00DE5DBE for m77 at libero.it; Wed, 13 Jul 2011 > 17:19:51 +0200 > Received: from mtalibero15.libero.it (EHLO mtalibero15.libero.it) > ([192.168.36.177]) > by mailrelay18.libero.it > with ESMTP id CWK28785; > Wed, 13 Jul 2011 17:19:51 +0200 (CEST) > Authentication-Results: mtalibero15.libero.it; dkim=neutral (message > not signed) header.i=none > Received-SPF: Pass identity=mailfrom; client-ip=213.186.60.119; > receiver=mtalibero15.libero.it; > envelope-from="dff-bounces at digital-forensic.org"; > x-sender="dff-bounces at digital-forensic.org"; > x-conformance=spf_only; > x-record-type="v=spf1" > X-LREMOTE-IP: 213.186.60.119 > Received: from mail.arxsys.fr ([213.186.60.119]) > by mtalibero15.libero.it with ESMTP; 13 Jul 2011 15:19:51 +0000 > Received: from mail.arxsys.fr (mail.arxsys.fr [213.186.60.119])) > by mail.arxsys.fr with ESMTP id 3982A32056; > Wed, 13 Jul 2011 17:19:50 +0200 (CEST) > X-Original-To: dff at digital-forensic.org > Delivered-To: dff at digital-forensic.org > Received: from mail.arxsys.fr (mail.arxsys.fr [213.186.60.119])) > by mail.arxsys.fr with ESMTP id D154831FCD > for ; Wed, 13 Jul 2011 17:19:47 +0200 > (CEST) > Received: from serveriii.mcr.net (87.2.39.55) by smtp205.alice.it > (8.5.124.08) > id 4DE634750446ECB1 for dff at digital-forensic.org; > Wed, 13 Jul 2011 17:19:47 +0200 > Received: from [192.168.10.220] (helo=monty.mcr.net) > by serveriii.mcr.net with esmtp (Exim 4.69) > (envelope-from ) id 1Qh1E1-0004Jj-Ll > for dff at digital-forensic.org; Wed, 13 Jul 2011 17:19:45 +0200 > Message-ID: <4E1DB6F6.1090404 at libero.it> > Date: Wed, 13 Jul 2011 17:17:10 +0200 > From: M77 > User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; it-IT; > rv:1.9.2.15) Gecko/20110308 Thunderbird/3.1.9 > MIME-Version: 1.0 > To: dff at digital-forensic.org > Subject: [dff] Problem executing DFF on FreeBSD > X-BeenThere: dff at digital-forensic.org > X-Mailman-Version: 2.1.14 > Precedence: list > List-Id: users discussions about DFF > List-Unsubscribe: , > > List-Archive: > List-Post: > List-Help: > List-Subscribe: , > > Content-Transfer-Encoding: 7bit > Content-Type: text/plain; charset="us-ascii"; Format="flowed" > Errors-To: dff-bounces at digital-forensic.org > Sender: dff-bounces at digital-forensic.org > X-Junkmail-Status: score=10/55, host=mailrelay18.libero.it > X-Junkmail-Signature-Raw: score=unknown, > refid=str=0001.0A0B020A.4E1DB797.014F,ss=1,re=0.000,fgs=0, > ip=213.186.60.119, > so=2011-06-21 16:49:39, > dmn=2011-06-08 23:29:05, > mode=multiengine > X-Junkmail-IWF: false > X-Mirapoint-Virus-RAPID-Raw: score=unknown(0), > refid=str=0001.0A0B020A.4E1DB797.014F,ss=1,re=0.000,fgs=0, > ip=213.186.60.119, > so=2011-06-21 16:49:39, > dmn=2011-06-08 23:29:05 > X-Mirapoint-Loop-Id: 0683437f02964298ed07dbbadeb322d1 > X-libjamoibt: 2587 > > Ok, now I've installed py-magic port from /usr/local/devel/py-magic > this solvet the first import error. > > now the errors is: > > Traceback (most recent call last): > File "/usr/local/lib/python2.6/site-packages/dff/dff.py", line 31, > in > from ui.ui import ui, usage > File "/usr/local/lib/python2.6/site-packages/dff/ui/ui.py", line 21, > in > from gui.gui import * > File "/usr/local/lib/python2.6/site-packages/dff/ui/gui/gui.py", > line 21, in > from mainwindow import MainWindow > File > "/usr/local/lib/python2.6/site-packages/dff/ui/gui/mainwindow.py", > line 52, in > from ui.gui.widget.help import Help > File > "/usr/local/lib/python2.6/site-packages/dff/ui/gui/widget/help.py", > line 21, in > from PyQt4.QtHelp import QHelpEngine > ImportError: No module named QtHelp > > > need check presence of these modules in my system... > > _______________________________________________ > dff mailing list > dff at digital-forensic.org > http://lists.digital-forensic.org/listinfo/dff From christophe.malinge at arxsys.fr Wed Jul 13 19:20:49 2011 From: christophe.malinge at arxsys.fr (Christophe Malinge) Date: Wed, 13 Jul 2011 19:20:49 +0200 Subject: [dff] Problem executing DFF on FreeBSD In-Reply-To: <4E1DCF4C.90208@libero.it> References: <4E1DB6F6.1090404@libero.it> <4E1DCF4C.90208@libero.it> Message-ID: <4E1DD3F1.7070609@arxsys.fr> On 07/13/11 19:01, M77 wrote: > Updated all py-qt4 library, and now error is: > > Traceback (most recent call last): > File "/usr/local/lib/python2.6/site-packages/dff/dff.py", line 31, in > > from ui.ui import ui, usage > File "/usr/local/lib/python2.6/site-packages/dff/ui/ui.py", line 21, in > > from gui.gui import * > File "/usr/local/lib/python2.6/site-packages/dff/ui/gui/gui.py", line > 21, in > from mainwindow import MainWindow > File "/usr/local/lib/python2.6/site-packages/dff/ui/gui/mainwindow.py", > line 32, in > from api.gui.widget.nodebrowser import NodeBrowser > File > "/usr/local/lib/python2.6/site-packages/dff/api/gui/widget/nodebrowser.py", > line 31, in > from api.gui.dialog.extractor import Extractor > File > "/usr/local/lib/python2.6/site-packages/dff/api/gui/dialog/extractor.py", line > 20, in > from PyQt4.Qt import * > File "/usr/local/lib/python2.6/site-packages/PyQt4/Qt.py", line 15, in > > from PyQt4.QtXmlPatterns import * > RuntimeError: the PyQt4.QtCore module is version 0 but the > PyQt4.QtXmlPatterns module requires version -1 > Seems very strange, a bit related to my problem ; RuntimeError: the sip module implements API v8.0 to v8.1 but the PyQt4.QtCore module requires API v7.1 But version reported on my system are 'relevant' except I have to update Qt and/or PyQt. I think you have to validate Qt <-> Sip <-> PyQt link is working fine, for example by trying to run every samples python files in : /usr/local/share/examples/py-qt4/**/*.py . If one example does not work it's a problem related to one of the three programs above. Another possible solution is to rebuild DFF from scratch. I saw you are not making an outsource build, so you'll have to try a 'make clean && make' or remove dff, uncompress source, comment/apply fuse patch again, and cmake+make again. Once I updated my system I'll can help you deeper. -- Christophe Malinge DFF, Core developer, System administrator ArxSys SAS, Directeur des syst?mes d'information T?l: +33 1 46 36 25 22 Fax: +33 9 55 52 90 57 From alexandreap at gmail.com Wed Jul 13 20:04:09 2011 From: alexandreap at gmail.com (alexandre augusto de paiva) Date: Wed, 13 Jul 2011 15:04:09 -0300 Subject: [dff] (no subject) Message-ID: -------------- next part -------------- An HTML attachment was scrubbed... URL: From m77 at libero.it Fri Jul 15 12:04:14 2011 From: m77 at libero.it (M77) Date: Fri, 15 Jul 2011 12:04:14 +0200 Subject: [dff] Bad allocation Message-ID: <4E20109E.6040603@libero.it> While analyzing 500GB HD with DFF I can't proceed opening one NTFS partition (~400GB) with ntfs module: DFF stop with "Bad allocation" message. I've tryed with dd hd image file, and phisical connected hd, and with windows and linux versions (1.1.0) on different machines but same error... No problems with other softwares. Hints? Thanks m1001101 From mr at atipico.com.br Sat Jul 16 20:00:00 2011 From: mr at atipico.com.br (=?UTF-8?Q?Rog=C3=A9rio_Madureira?=) Date: Sat, 16 Jul 2011 15:00:00 -0300 Subject: [dff] List all ext4 inodes from a damaged filesystem... Message-ID: Hello everybody. I have a diskimage with a damaged ext4 filesystem. And I am trying to list all inodes of this filesystem. Loading the image and then selecting *Open with > File systems > extfs >> ils *gives me this error: Extfs::start() : vfsError exeption caught : -> Error while reading extfs superblock. Exiting. Indeed, choosing any of the options od extfs results in the same error. i guess it's because ils doesn't understands ext4 filesystems. Does anybody know a better way to list a ext4 inodes from a damaged filesystem? Thanks, Rogerio. -------------- next part -------------- An HTML attachment was scrubbed... URL: From m77 at libero.it Mon Jul 18 10:04:46 2011 From: m77 at libero.it (M77) Date: Mon, 18 Jul 2011 10:04:46 +0200 Subject: [dff] DFF work on FreeBSD 8.2 i386! Message-ID: <4E23E91E.6030907@libero.it> During last week-end I've "portupgraded" all system, now dff start correctly in console and graphic mode. In the coming days will test the functionality. m1001101 From solal.jacob at ArxSys.fr Tue Jul 19 14:49:55 2011 From: solal.jacob at ArxSys.fr (Solal Jacob) Date: Tue, 19 Jul 2011 12:49:55 +0000 Subject: [dff] List all ext4 inodes from a damaged filesystem... In-Reply-To: References: Message-ID: <4E257D73.5000908@ArxSys.fr> Hello Rogerio, The extfs module is compatible with ext2/3/4 but it certainly need to find the super block first to be able to list the inodes, I think it doesn't search for inode 'header' (doing carving), Romain who developed the module should confirm that. Thanks, Solal On 07/16/11 18:00, Rog?rio Madureira wrote: > Hello everybody. > > I have a diskimage with a damaged ext4 filesystem. And I am trying to > list all inodes of this filesystem. Loading the image and then > selecting *Open with > File systems > extfs >> ils *gives me this error: > > Extfs::start() : vfsError exeption caught : > > -> Error while reading extfs superblock. Exiting. > > > Indeed, choosing any of the options od extfs results in the same > error. i guess it's because ils doesn't understands ext4 filesystems. > > Does anybody know a better way to list a ext4 inodes from a damaged > filesystem? > > Thanks, > Rogerio. > > > _______________________________________________ > dff mailing list > dff at digital-forensic.org > http://lists.digital-forensic.org/listinfo/dff > -- Solal Jacob solal.jacob at arxsys.fr ArxSys, Riposte Num?rique 14-16, Rue du Soleillet 75020 Paris T?l: +33 1 46 36 25 22 www.arxsys.fr www.digital-forensic.org -------------- next part -------------- An HTML attachment was scrubbed... URL: From solal.jacob at ArxSys.fr Tue Jul 19 14:52:45 2011 From: solal.jacob at ArxSys.fr (Solal Jacob) Date: Tue, 19 Jul 2011 12:52:45 +0000 Subject: [dff] Bad allocation In-Reply-To: <4E20109E.6040603@libero.it> References: <4E20109E.6040603@libero.it> Message-ID: <4E257E1D.6000907@ArxSys.fr> Hello M77, The NTFS modules have some bug that need to be fixed, it also use lot of memory. The modules will have some bug fixed for DFF 1.2 and will be entirely rewritten for DFF 1.3. Thanks, Solal. On 07/15/11 10:04, M77 wrote: > While analyzing 500GB HD with DFF I can't proceed opening one NTFS > partition (~400GB) with ntfs module: DFF stop with "Bad allocation" > message. I've tryed with dd hd image file, and phisical connected hd, > and with windows and linux versions (1.1.0) on different machines but > same error... > No problems with other softwares. > > Hints? > > Thanks > > m1001101 > _______________________________________________ > dff mailing list > dff at digital-forensic.org > http://lists.digital-forensic.org/listinfo/dff -- Solal Jacob solal.jacob at arxsys.fr ArxSys, Riposte Num?rique 14-16, Rue du Soleillet 75020 Paris T?l: +33 1 46 36 25 22 www.arxsys.fr www.digital-forensic.org From killboy_powerhed at yahoo.com.au Sat Jul 30 15:01:22 2011 From: killboy_powerhed at yahoo.com.au (KillBoy PowerHed) Date: Sat, 30 Jul 2011 06:01:22 -0700 (PDT) Subject: [dff] AFF support when compiling dff-1-1-0 on Fedora 15 x86_64 Message-ID: <1312030882.83561.YahooMailNeo@web39402.mail.mud.yahoo.com> Hi, Just wondered if anyone could assist with $subject, I'm getting the "AFF library not found..." message. Looking at CMakeLists.txt I found this comment: ?# Link with static version at install, until AFF >= 3.6 be added to respective packages streams I have afflib 3.6.12 installed, can I make the install use the shared library easily ? thanks