tsk filefinder results not showing in Browse Virtual Filesystem>fs>tsk v. 3.3.0.0

tsk results not showing in Browse Virtual Filesystem>fs>tsk Error:

Backtrace

Traceback (most recent call last): File “/usr/share/grr-server/local/lib/python2.7/site-packages/grr_response_server/flow_base.py”, line 564, in RunStateMethod method(responses) File “/usr/share/grr-server/local/lib/python2.7/site-packages/grr_response_server/flows/general/filesystem.py”, line 189, in List raise flow.FlowError(str(responses.status)) FlowError: message FlowStatus { backtrace : u’’ client_id : u’C.51a51cf2cde50b32’ cpu_time_used : message CpuSeconds { system_cpu_time : 0.0 user_cpu_time : 0.0 } error_message : u’path \ is not mounted under C:’ flow_id : u’DC5945FA’ network_bytes_sent : 127 request_id : 2 response_id : 1 status : IOERROR }

Running just File Finder flow to hash files in %%environ_systemdrive%%/* via tsk - completed with no errors but still shows nothing in Browse Virtual Filesystem>fs>tsk view

Trying to run “refresh” on Browse Virtual Filesystem>fs>tsk>\\?\Volume{~ after File Finder does not produce IOERROR anymore and just shows nothing outside flow results in Manage Launched Flows

I would appreciate any and all guidance or advice on what may be broken/misconfigured and/or how to fix it 😃

Thanks!

[ogarod]

This was helpful, thanks!

I actually don’t think you are doing anything wrong. Files should appear in the VFS browser in the Admin UI after they are collected. What I think is going wrong is that collected file paths end up with a leading forward slash that shouldn’t be there. Therefore, any database queries to fetch directory contents fail to match the intended paths. This is something we should fix.

[mbushkov]

@vorsklaa, do I understand it correctly that doing FileFinder with TSK for “C:/*” produces entries that you then see in Browse Virtual Filesystem? At the moment, using FileFinder (or ClientFileFinder) to make paths appear under TSK is a workaround you have to use. After the paths are there, you can use the “Refresh” button to browse them. I’ve opened a more specific https://github.com/google/grr/issues/727 to track this issue.