You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
org.apache.tika.exception.TikaException: TIKA-198: Illegal IOException from dpf.inc.sepinf.UsnJrnl.UsnJrnlParser@45224d17
at org.apache.tika.parser.CompositeParser.parse(CompositeParser.java:286) ~[tika-core-1.26.jar:1.26]
at dpf.sp.gpinf.indexer.parsers.IndexerDefaultParser.parse(IndexerDefaultParser.java:244) [iped-parsers-impl-4.0.0-snapshot.jar:?]
at dpf.sp.gpinf.indexer.io.ParsingReader$BackgroundParsing.run(ParsingReader.java:247) [iped-engine-4.0.0-snapshot.jar:?]
at java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source) [?:1.8.0_152]
at java.util.concurrent.FutureTask.run(Unknown Source) [?:1.8.0_152]
at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) [?:1.8.0_152]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) [?:1.8.0_152]
at java.lang.Thread.run(Unknown Source) [?:1.8.0_152]
Caused by: java.io.IOException: mark/reset not supported
at java.io.InputStream.reset(Unknown Source) ~[?:1.8.0_152]
at dpf.sp.gpinf.indexer.util.SleuthkitInputStream.reset(SleuthkitInputStream.java:82) ~[iped-engine-4.0.0-snapshot.jar:?]
at dpf.inc.sepinf.UsnJrnl.UsnJrnlParser.findNextEntry(UsnJrnlParser.java:76) ~[iped-parsers-impl-4.0.0-snapshot.jar:?]
at dpf.inc.sepinf.UsnJrnl.UsnJrnlParser.parse(UsnJrnlParser.java:228) ~[iped-parsers-impl-4.0.0-snapshot.jar:?]
at org.apache.tika.parser.CompositeParser.parse(CompositeParser.java:280) ~[tika-core-1.26.jar:1.26]
... 7 more
SleuthkitInputStream just pass some calls to Sleuthkit ReadContentInputStream and it doesn't support mark/reset, but this parser is not checking that with markSupported()
The text was updated successfully, but these errors were encountered:
lfcnassif
changed the title
NTFS USN Journal parsing fails when processing image files
NTFS USN Journal parsing fails when processing disk images if indexTempOnSSD = false or if journal size > 1GB
Jul 17, 2021
Stacktrace:
SleuthkitInputStream just pass some calls to Sleuthkit ReadContentInputStream and it doesn't support mark/reset, but this parser is not checking that with markSupported()
The text was updated successfully, but these errors were encountered: