Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Get-ForensicFileRecord : Destination array was not long enough. #160

Open
RoYoMi opened this issue Sep 26, 2019 · 0 comments
Open

Get-ForensicFileRecord : Destination array was not long enough. #160

RoYoMi opened this issue Sep 26, 2019 · 0 comments

Comments

@RoYoMi
Copy link

RoYoMi commented Sep 26, 2019

The following command works for other drives on the same server but fails when I use D:
$AllFiles = $(Get-ForensicFileRecord -volume d:)

Error message:
Get-ForensicFileRecord : Destination array was not long enough. Check destIndex and length, and the array's lower
bounds.
At line:1 char:15

  • $AllFiles = $(Get-ForensicFileRecord -volume d:)
  •           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    
    • CategoryInfo : NotSpecified: (:) [Get-ForensicFileRecord], ArgumentException
    • FullyQualifiedErrorId : System.ArgumentException,PowerForensics.Cmdlets.GetFileRecordCommand

Stack Trace:
PS C:> $Stacktrace
at System.Array.Copy(Array sourceArray, Int32 sourceIndex, Array destinationArray, Int32 destinationIndex, Int32 leng
th, Boolean reliable)
at PowerForensics.Ntfs.DataRun..ctor(Byte[] bytes, Int32 offset, Int32 lengthByteCount, Int32 offsetByteCount, DataRu
n previousDR) in C:\Users\tester\Documents\GitHub\PowerForensics\PowerForensics\src\FileSystems\Ntfs\Attributes\NonResid
ent\DataRun.cs:line 34
at PowerForensics.Ntfs.DataRun.GetInstances(Byte[] bytes) in C:\Users\tester\Documents\GitHub\PowerForensics\PowerFor
ensics\src\FileSystems\Ntfs\Attributes\NonResident\DataRun.cs:line 68
at PowerForensics.Ntfs.NonResident..ctor(NonResidentHeader header, Byte[] bytes, String attrName) in C:\Users\tester
Documents\GitHub\PowerForensics\PowerForensics\src\FileSystems\Ntfs\Attributes\NonResident\NonResident.cs:line 44
at PowerForensics.Ntfs.FileRecordAttribute.Get(Byte[] bytes, String volume) in C:\Users\tester\Documents\GitHub\Power
Forensics\PowerForensics\src\FileSystems\Ntfs\Attributes\FileRecordAttribute.cs:line 168
at PowerForensics.Ntfs.FileRecord..ctor(Byte[] recordBytes, String volume, Boolean fast) in C:\Users\tester\Documents
\GitHub\PowerForensics\PowerForensics\src\FileSystems\Ntfs\FileRecord\FileRecord.cs:line 142
at PowerForensics.Ntfs.MasterFileTable.GetRecord(FileStream streamToRead, String volume) in C:\Users\tester\Documents
\GitHub\PowerForensics\PowerForensics\src\FileSystems\Ntfs\MasterFileTable.cs:line 24
at PowerForensics.Ntfs.FileRecord.GetRecordBytesPrivate(String volume, Int32 index) in C:\Users\tester\Documents\GitH
ub\PowerForensics\PowerForensics\src\FileSystems\Ntfs\FileRecord\FileRecord.cs:line 477
at PowerForensics.Cmdlets.GetFileRecordCommand.ProcessRecord() in C:\Users\tester\Documents\GitHub\PowerForensics\Pow
erForensics\src\Cmdlets\FileSystems\Ntfs\Get-ForensicFileRecord.cs:line 118
at System.Management.Automation.CommandProcessor.ProcessRecord()
PS C:>

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant