Page tree
Skip to end of metadata
Go to start of metadata

This section will include information on specific error messages and how (if at all) to respond.  It will be under fairly constant development.

General Errors

Windows Permission Error

After the BDPL Ingest Tool scripts have been updated from GitHub, you have to reset the permissions.  If this step hasn't been performed, you will get an error message noting 'You may not have the appropriate permissions to access the item' when you click BDPL_launch.bat:

To correct this issue, navigate to C:\BDPL\scripts via the Windows File Manager, right-click on the folder, and then select 'Properties' from the context menu.  Once the Properties window opens, select the 'Security' tab and click the 'Advanced' button:

A new window will open; check the box in the bottom left corner and then click 'Apply'; the updated scripts are now ready to run!

Python Traceback Reports

The BDPL Ingest Tool was developed using the Python programming language.  When the Python interpreter encounters an error and cannot proceed, it produces a 'Traceback' report, which includes a specific error message as well as a reference to the line in the code where the problem occurred.  Here's an example:

If you encounter a Python Traceback, take a screenshot and send it to the BDPL manager via Slack.  It may be a bug in the BDPL Ingest Tool code, which needs to be fixed immediately, or a unique issue with a file or directory.

Errors when Loading a Record

When loading a barcode record at the beginning of a session, the Ingest Tool will produce an error message in the CMD.EXE window if any of the basic information (barcode, unit, and/or shipment date) is missing.  For example, if the shipment date is not entered, the tool notes "Error; please make sure you have entered a shipment date."

The Ingest Tool will also produce an error message if the barcode value is not found on the 'Inventory' worksheet of the BDPL manifest. 

If the required information is missing, just enter it in the correct location and click the 'Load' button.

For barcode errors, if you are sure the value has been entered correctly follow the file path indicated in the error message to open the BDPL manifest.  Check the 'Inventory' worksheet to see if the barcode was entered incorrectly or if it's missing.  In the latter case, notify the BDPL manager so that the collecting unit can be contacted and an appropriate barcode received for the Inventory.

Transfer Errors

Missing Information

As noted in a previous section, if any of the basic information (barcode, unit, or shipment ID) is missing, the Ingest Tool will inform the user of the problem with an error in the CMD.EXE window.  For example, if the shipment date is not entered, the tool notes "Error; please make sure you have entered a shipment date."

The Ingest Tool will also produce an error message if the barcode value is not found on the 'Inventory' worksheet of the BDPL manifest. 

If you are sure the barcode has been entered correctly, then follow the file path indicated in the error message to open the BDPL manifest and check to see if the barcode was entered incorrectly in the 'Inventory' spreadsheet.  (Non-barcode values may have been mis-keyed.) Notify the BDPL manager if the barcode is missing so that the collecting unit can add it to the Inventory.

ddrescue: Can't open input file: No such device or address

If you have forgotten to connect the 3.5" floppy disk drive before clicking the 'Transfer' button, the CMD.EXE windows will note 'ddrescue: Can't open input file: No such device or address' and also that 'disk image creation failed.'

To fix, make sure the 3.5" floppy drive is connected and then re-run the Transfer process.

Zip drive not recognized

If you have forgotten to connect the Zip disk drive OR if the Zip drive has not been recognized by the BDPL workstation before you click the 'Transfer' button, the CMD.EXE windows will report ' Zip drive not recognized':

To fix, reconnect the Zip disk drive; wait approx. 20 seconds and/or check to see if a new drive letter appears in the Windows File Manager to verify that the drive has been recognized.

FC5025 WinDIB Fails to Read Disk

n some cases, the WinDIB software will fail to read any information on a 5.25" software, giving an 'Unable to get the file listing!' error message:

In such cases, we will still attempt to recover data, using the most frequently found disk type in the shipment (usually MS-DOS 360K and MS-DOS 1200K, in that order).

File Replication from Disk Image Fails

In some cases, the Ingest Tool will successfully create a disk image, but no files will be replicated from it.   The CMD.EXE window will report 'Files recovered: 0' and 'Error; no files located at Z:\UNIT\ingest\shipmentID\BARCODE\files. Check settings and run again; you may need to manually copy or extract files.'

There may be no actual data on the disk, but sometime, the issue is a problem with the disk's file system.  Our primary tool for troubleshooting will be FTK Imager, though 5.25" floppies may require the use of the FC5025 WinDIB application.

Manually Replicating Files from Disk Images

FTK Imager Instructions

Follow these steps to check the disk image for any recoverable content:

  • Launch FTK Imager via the desktop icon or through the Start menu program list.  FTK Imager requires admin privileges to run; sign in using the "dplstaff" user account.

  • Copy the disk image to the C:\files folder on the workstation (if it doesn't exist, create the folder).

  • Click the 'Add Evidence Item' icon on the left side of the FTK Imager ribbon:


  • A 'Select Source' dialog box will open; select 'Image File' and click 'Next'. 


  • A new dialog box will open; click the 'Browse' button, navigate to the disk image file in C:\files and then click 'Finish.'


  • The disk image will now be loaded in the 'Evidence Tree' pane.  Expand the disk image by clicking the small '+' icon next to the file name.  Expand additional levels as needed:


    • The top level of the Evidence Tree (i.e., immediately below the disk image name) will be the file system (if present); it may or may not have a name. Within the file system will be a folder for the saved files (if any exist; this is a directory typically named '[root]') and another called '[unallocated space]', which is empty or contains the remnants of deleted files.  We are only interested in the 'root' folder with allocated files.
    • NOTE: the disk image may contain multiple partitions, each of which will have a separate file system.  Consult with the BDPL Manager on how to address.

Outcomes

Files Found
  • Create a folder with the barcode name in C:\files (i.e., "C:\files\30000152012435").

  • Right click on the [root] folder and select 'Export files' from the context menu:


  • A new dialog box will open; browse to the barcode folder, select it, and then click 'OK.'
  • FTK Imager will attempt to export the files and indicate how many were successfully exported:


  • You should now run bdpl_manual_premis.py to (a) document the file replication and (b) move the files to the barcode folder. (Documentation forthcoming)
Unrecognized File System

FTK Imager may indicate that the disk image contains an 'Unrecognized file system; of 'unknown type':

If this occurs, we are unable to recover data.  In the Ingest Tool interface, write "Unrecognized file system; unable to recover data." in the 'BDPL Note' field, check the 'Failed transfer?' box and click 'Save'.

The CMD.EXE window will indicate the note and failed status have been saved to the Appraisal worksheet of the BDPL manifest.  You do not need to run the Analysis process and may proceed to the next barcode item.

Backup Files

In the 1980s and 1990s, user would frequently backup their computers to 3.5" and 5.25" floppy disks using programs such as FASTBAK and MWBACKUP.  A single backup could require numerous disks.

When viewed in FTK Imager, there will be a single file on the disk (usually with an extension like '.001') and the file system will have the same base name as the backup file (i.e., 'C940629B')

As these backups require specialized software to open and reconstitute the original data, we are unable to replicate any files.  Instead, we will let the collecting unit make a decision about retaining the files.  In the Ingest Tool, write "Disk Image includes back up file; unable to extract" in the BDPL Note field and click save. 

The information will be recorded in the BDPL manifest for the unit to review; proceed to run the Analysis process as normal.  

Manually Replicating Files from 5.25" Floppies

Follow Standard Procedures with FTK Imager

If the Ingest Tool produces a disk image for a 5.25" floppy disk and no files are replicated, try to view the disk image in FTK Imager as described above. 

If FTK Imager is unable to recognize the disk's file system, the next steps will be dictated by the FC5025 WinDIB software's ability to read the disk 

FC5025 WinDIB Reads File Listing

When checking the disk type of a 5.25" floppy disk, the FC5025 WinDIB software will display a list of file names if it can read the disk:

 

If WinDIB can read the disk but normal Ingest Tool procedures fail to replicate files, it will be necessary to manually copy content.  Unfortunately, there are no batch operations so files will need to be copied one by one. Follow these instructions:

  • If it does not already exist, create a folder called "C:\a-files" on the workstation (more about this later...)

  • Launch the WinDIB software; once the correct Disk Type is selected, click the 'Browse Disk Contents' button.


  • When the 'Browsing Disk Contents...' window opens, select a file and click 'Copy File'


  • A new 'Save as' dialog box will open; click on 'C:\' and then the 'a-files' folder and then click 'OK'


    NOTE: WinDIB will allow us to save directly to the barcode folder on Scandium, but the primitive interface would mean you have to click through many, many folders to save a file.  It's thus easier to save the files locally and then move them to the Scandium later.
  • Repeat until all the files are copied.  We will then attempt to collect the originally last-modified dates displayed in the WinDIB browse interface.

Analysis Errors

Identified Viruses

If an item includes content infected with a virus or malware, several analysis micro-services will report errors in the CMD.EXE window.  In particular, the Siegfried file format identification tool and bulk_extractor sensitive information identification tool will report errors when skipping infected files, as shown below:

This is normal behavior and will not pose any problems.

Siegfried: [ERROR] empty source

If the Siegfried file format identification tool encounters a file with 0 bytes, will produce an error message in the CMD.EXE window: '[ERROR] empty source', as shown below:

This is normal behavior and will not pose any problems.

bulk_extractor

Exception Read Errors

As noted above, bulk_extractor will produce a read error when attempting to scan a file that has been identified as having a virus:

bulk_extractor also has a known issue on Windows where it will produce a read error exception when it encounters Unicode characters in a filename:

These issues will be recorded in the bulk_extractor logs; at this time we have no workaround.

Carve: Cannot Create; No Such File or Directory

As part of its scan for sensitive data, bulk_extractor will 'carve' .ZIP and other archive files so that the individual files may be reviewed.  This operation periodically results in error messages that note the 'carve' command could not create a specific file:

This issue will be recorded in the bulk_extractor logs; at this time, we have no workaround.


  • No labels