Unsupported L01 format

[ankurkgupta]

ewfexport fails on valid L01 file unsupported_sample.zip

with following error:

ewfexport 20240506 
  
Unable to export single files. 
libcdata_array_get_entry_by_index: invalid entry index value out of bounds. 
libewf_single_files_get_permission_group_by_index: unable to retrieve entry: 1 from permission groups array. 
libewf_file_entry_initialize: unable to retrieve permission group: 1. 
libewf_file_entry_get_sub_file_entry: unable to initialize sub file entry. 
export_handle_export_file_entry_sub_file_entries: unable to free retrieve sub file entry: 0. 
export_handle_export_file_entry: unable to export sub file entries. 
export_handle_export_single_files: unable to export root file entry. 

Other tools are able to open this file, so the file is valid L01 file.
ewfverify and ewfinfo command works fine on this file

Output of ewfinfo:

Acquiry information: 
	Case number:		Case1 
	Description:		Test 
	Examiner name:		Examiner1 
	Evidence number:	1 
	Notes:			Additional notes...   
	Acquisition date:	Tue Dec 17 05:27:51 2024 
	System date:		Tue Dec 17 05:27:51 2024 
	Operating system used:	Windows 10 
	Software version used:	FI2(299) 
	Password:		N/A 
	Unknown value dc:	G:\Desktop\L01\unsupported_sample.L01 
 
EWF information: 
	File format:		Logical Evidence File (LEF) EnCase 6 
	Sectors per chunk:	64 
	Compression method:	deflate 
	Compression level:	no compression 
 
Media information: 
	Media type:		single files 
	Is physical:		no 
	Bytes per sector:	4096 
	Number of sectors:	64 
	Media size:		256 KiB (262144 bytes) 
 
Digest hash information: 
	MD5:			adbf2ab1595a7c2f8a0ef17fd6408545 
	SHA1:			8ff32dd41f25289353a20881262bdf5bbb54a27e

[joachimmetz]

thanks for the report I'll have a look when time permits.

[ankurkgupta]

@joachimmetz, I noticed that it works with your legacy library version 20140807

[joachimmetz]

Yeah that is why the readme says this version is experimental