This section will include information on specific error messages and how (if at all) to respond. It will be under fairly constant development.
|Table of Contents|
Windows Permission Error
After the BDPL Ingest Tool scripts have been updated from GitHub, you have to reset the permissions. If this step hasn't been performed, you will get an error message noting 'You may not have the appropriate permissions to access the item' when you click BDPL_launch.bat:
Python Traceback Reports
The BDPL Ingest Tool was developed using the Python programming language. When the Python interpreter encounters an error and cannot proceed, it produces a 'Traceback' report, which includes a specific error message as well as a reference to the line in the code where the problem occurred. Here's an example:
If you encounter a Python Traceback, take a screenshot and send it to the BDPL manager via Slack. It may be a bug in the BDPL Ingest Tool code, which needs to be fixed immediately, or a unique issue with a file or directory.
Errors when Loading a Record
When loading a barcode record at the beginning of a session, the Ingest Tool will produce an error message in the CMD.EXE window if any of the basic information (barcode, unit, and/or shipment date) is missing. For example, if the shipment date is not entered, the tool notes "Error; please make sure you have entered a shipment date."
For barcode errors, if you are sure the value has been entered correctly follow the file path indicated in the error message to open the BDPL manifest. Check the 'Inventory' worksheet to see if the barcode was entered incorrectly or if it's missing. In the latter case, notify the BDPL manager so that the collecting unit can be contacted and an appropriate barcode received for the Inventory.
As noted in a previous section, if any of the basic information (barcode, unit, or shipment ID) is missing, the Ingest Tool will inform the user of the problem with an error in the CMD.EXE window. For example, if the shipment date is not entered, the tool notes "Error; please make sure you have entered a shipment date."
If you are sure the barcode has been entered correctly, then follow the file path indicated in the error message to open the BDPL manifest and check to see if the barcode was entered incorrectly in the 'Inventory' spreadsheet. (Non-barcode values may have been mis-keyed.) Notify the BDPL manager if the barcode is missing so that the collecting unit can add it to the Inventory.
ddrescue: Can't open input file: No such device or address
If you have forgotten to connect the 3.5" floppy disk drive before clicking the 'Transfer' button, the CMD.EXE windows will note 'ddrescue: Can't open input file: No such device or address' and also that 'disk image creation failed.'
To fix, make sure the 3.5" floppy drive is connected and then re-run the Transfer process.
Zip drive not recognized
If you have forgotten to connect the Zip disk drive OR if the Zip drive has not been recognized by the BDPL workstation before you click the 'Transfer' button, the CMD.EXE windows will report ' Zip drive not recognized':
To fix, reconnect the Zip disk drive; wait approx. 20 seconds and/or check to see if a new drive letter appears in the Windows File Manager to verify that the drive has been recognized.
FC5025 WinDIB Fails to Read Disk
n some cases, the WinDIB software will fail to read any information on a 5.25" software, giving an 'Unable to get the file listing!' error message:
In such cases, we will still attempt to recover data, using the most frequently found disk type in the shipment (usually MS-DOS 360K and MS-DOS 1200K, in that order).
File Replication from Disk Image Fails
In some cases, the Ingest Tool will successfully create a disk image, but no files will be replicated from it. The CMD.EXE window will report 'Files recovered: 0' and 'Error; no files located at Z:\UNIT\ingest\shipmentID\BARCODE\files. Check settings and run again; you may need to manually copy or extract files.'
There may be no actual data on the disk, but sometime, the issue is a problem with the disk's file system. Our primary tool for troubleshooting will be FTK Imager, though 5.25" floppies may require the use of the FC5025 WinDIB application.
Manually Replicating Files from Disk Images
FTK Imager Instructions
Follow these steps to check the disk image for any recoverable content:
- Copy the disk image to the C:\files folder on the workstation (if it doesn't exist, create the folder).
- Click the 'Add Evidence Item' icon on the left side of the FTK Imager ribbon:
- A 'Select Source' dialog box will open; select 'Image File' and click 'Next'.
- A new dialog box will open; click the 'Browse' button, navigate to the disk image file in C:\files and then click 'Finish.'
- The disk image will now be loaded in the 'Evidence Tree' pane. Expand the disk image by clicking the small '+' icon next to the file name. Expand additional levels as needed:
- The top level of the Evidence Tree (i.e., immediately below the disk image name) will be the file system (if present); it may or may not have a name. Within the file system will be a folder for the saved files (if any exist; this is a directory typically named '[root]') and another called '[unallocated space]', which is empty or contains the remnants of deleted files. We are only interested in the 'root' folder with allocated files.
- NOTE: the disk image may contain multiple partitions, each of which will have a separate file system. Consult with the BDPL Manager on how to address.
- Create a folder with the barcode name in C:\files (i.e., "C:\files\30000152012435").
- Right click on the [root] folder and select 'Export files' from the context menu:
- A new dialog box will open; browse to the barcode folder, select it, and then click 'OK.'
- FTK Imager will attempt to export the files and indicate how many were successfully exported:
- You should now run bdpl_manual_premis.py to (a) document the file replication and (b) move the files to the barcode folder. (Documentation forthcoming)
Unrecognized File System
FTK Imager may indicate that the disk image contains an 'Unrecognized file system; of 'unknown type':
The CMD.EXE window will indicate the note and failed status have been saved to the Appraisal worksheet of the BDPL manifest. You do not need to run the Analysis process and may proceed to the next barcode item.
In the 1980s and 1990s, user would frequently backup their computers to 3.5" and 5.25" floppy disks using programs such as FASTBAK and MWBACKUP. A single backup could require numerous disks.
The information will be recorded in the BDPL manifest for the unit to review; proceed to run the Analysis process as normal.
Manually Replicating Files from 5.25" Floppies
Follow Standard Procedures with FTK Imager
If the Ingest Tool produces a disk image for a 5.25" floppy disk and no files are replicated, try to view the disk image in FTK Imager as described above.
If FTK Imager is unable to recognize the disk's file system, the next steps will be dictated by the FC5025 WinDIB software's ability to read the disk
FC5025 WinDIB Reads File Listing
When checking the disk type of a 5.25" floppy disk, the FC5025 WinDIB software will display a list of file names if it can read the disk:
- If it does not already exist, create a folder called "C:\a-files" on the workstation (more about this later...)
- Launch the WinDIB software; once the correct Disk Type is selected, click the 'Browse Disk Contents' button.
- When the 'Browsing Disk Contents...' window opens, select a file and click 'Copy File'
- A new 'Save as' dialog box will open; click on 'C:\' and then the 'a-files' folder and then click 'OK'
NOTE: WinDIB will allow us to save directly to the barcode folder on Scandium, but the primitive interface would mean you have to click through many, many folders to save a file. It's thus easier to save the files locally and then move them to the Scandium later.
- Repeat until all the files are copied. We will then attempt to collect the originally last-modified dates displayed in the WinDIB browse interface.
If an item includes content infected with a virus or malware, several analysis micro-services will report errors in the CMD.EXE window. In particular, the Siegfried file format identification tool and bulk_extractor sensitive information identification tool will report errors when skipping infected files, as shown below:
This is normal behavior and will not pose any problems.
Siegfried: [ERROR] empty source
If the Siegfried file format identification tool encounters a file with 0 bytes, will produce an error message in the CMD.EXE window: '[ERROR] empty source', as shown below:
This is normal behavior and will not pose any problems.
Exception Read Errors
As noted above, bulk_extractor will produce a read error when attempting to scan a file that has been identified as having a virus:
These issues will be recorded in the bulk_extractor logs; at this time we have no workaround.
Carve: Cannot Create; No Such File or Directory
As part of its scan for sensitive data, bulk_extractor will 'carve' .ZIP and other archive files so that the individual files may be reviewed. This operation periodically results in error messages that note the 'carve' command could not create a specific file: