Comments (5)
Thanks for the Stack Trace. Looks like you are using one of the older versions of PowerForensics. Can you try downloading the newest version (https://github.com/Invoke-IR/PowerForensics/tree/master/Modules/PowerForensics)?
from powerforensics.
If the issue persists with the newer version, is it possible for you to share the MFT with me (Exported via some other tool)? That'd help me figure out where the specific issue is occurring. If not I completely understand.
from powerforensics.
Hi Jared, - Unfortunately, no dice. Slightly different error, but I presume that's to do with the newer version of PF.
PS C:\WINDOWS\system32> Get-ForensicFileRecord
Exception calling "GetInstances" with "1" argument(s): "Non-negative number required.
Parameter name: count"
At C:\Users\xxxxxx\Documents\WindowsPowerShell\Modules\PowerForensics\PowerForensics.psm1:958 char:21
-
Write-Output ([PowerForensics.FileSystems.Ntfs.FileRecord]:: ...
-
+ CategoryInfo : NotSpecified: (:) [], MethodInvocationException + FullyQualifiedErrorId : ArgumentOutOfRangeException
PS C:\WINDOWS\system32> $stacktrace
at System.Text.UnicodeEncoding.GetString(Byte[] bytes, Int32 index, Int32 count)
at PowerForensics.FileSystems.Ntfs.VolumeName..ctor(ResidentHeader header, Byte[] bytes, Int32 offset, String attrName)
at PowerForensics.FileSystems.Ntfs.FileRecordAttribute.Get(Byte[] bytes, Int32 offset, String volume)
at PowerForensics.FileSystems.Ntfs.FileRecordAttribute.GetInstances(Byte[] bytes, Int32 offset, Int32 bytesPerFileRecord, String volume)
at PowerForensics.FileSystems.Ntfs.FileRecord..ctor(FileRecord[]& recordArray, Byte[] bytes, Int32 offset, Int32 bytesPerFileRecord, Str
ing volume, Boolean fast)
at PowerForensics.FileSystems.Ntfs.FileRecord..ctor(FileRecord[]& recordArray, Byte[] bytes, Int32 offset, Int32 bytesPerFileRecord, Str
ing volume, Boolean fast)
at PowerForensics.FileSystems.Ntfs.FileRecord.GetInstances(Byte[] bytes, String volume, Boolean fast)
at CallSite.Target(Closure , CallSite , RuntimeType , String )
PS C:\WINDOWS\system32>
Would like to pass you the MFT but as it is from a work machine I'm afraid I'm not going to be able to. Happy to perform any diagnostics you would like though, or provide you the parsed output of analyzeMFT, Triforce etc if that will help.
from powerforensics.
Ok give me a day or so to put together a verbose version for you to test with. That way it will tell us exactly what record the issue is occurring on and we can work on it from there.
from powerforensics.
Sorry I forgot to mention i managed to try on another machine in the fleet and it ran fine (and I had not previously experienced these errors), so please don't do any extra work on my account as it seems to be related to that one machine. Having said that, still happy to help you debug if you want to get to the bottom of it though.
from powerforensics.
Related Issues (20)
- Implement FSCTL_ENUM_USN_DATA HOT 7
- Copy-ForensicFile issue HOT 9
- PowerShell Remoting Usage HOT 3
- Type [PowerForensic.Ntfs.FileRecord] not found HOT 21
- Get-ForensicTimeline Amcache Error on Windows 7 HOT 1
- Get-ForensicFileRecord : Array dimensions exceeded supported range. HOT 5
- Get-ForensicFileRecord : Path not found HOT 1
- Powershell Gallery
- AmCache Parser Update HOT 1
- Forensic Timeline Type
- Error when using any cmdlet
- Volume Shadow Copies HOT 1
- PowerForensicsPortable Issue
- Get-ForensicFileRecord : Destination array was not long enough.
- Get-ForensicPrefetch needs to be updated to take in to account compressed pf files in Win10
- Add Feature Invoke-ForensicDD
- Issues with Windows Server 2019
- `Get-ForensicFileRecord` broken by Windows 11?
- Get-ForensicAmcache returns an error HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from powerforensics.