Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

volicon: missing 'iconpath' option Unable to create fuse handle. #117

Closed
mark-hallman opened this issue Nov 21, 2018 · 12 comments
Closed

volicon: missing 'iconpath' option Unable to create fuse handle. #117

mark-hallman opened this issue Nov 21, 2018 · 12 comments
Assignees
Labels

Comments

@mark-hallman
Copy link

@mark-hallman mark-hallman commented Nov 21, 2018

When I run ewfmount I get the following message. Thought on what I could be doing wrong?

Marks-MacBook-Pro:~ mark$ sudo ewfmount cases/nromanoff.E01 ewf_mount/
Password:
ewfmount 20171104

volicon: missing 'iconpath' option
Unable to create fuse handle.
Marks-MacBook-Pro:~ mark$

Software
macOS Majave 10.14 - Started with complete fresh install
X-Code
X-Code command line tools
Fuse for macOS

Output from ./configure

Building:
libcerror support: local
libcthreads support: local
libcdata support: local
libcdatetime support: local
libclocale support: local
libcnotify support: local
libcsplit support: local
libuna support: local
libcfile support: local
libcpath support: local
libbfio support: local
libfcache support: local
libfdata support: local
libfguid support: local
libfvalue support: local
ADLER32 checksum support: zlib
DEFLATE compression support: zlib
BZIP2 compression support: bzip2
libhmac support: local
MD5 support: local
SHA1 support: local
SHA256 support: local
libcaes support: local
AES support: local
libodraw support: local
libsmdev support: local
libsmraw support: local
GUID/UUID support: native
FUSE support: libosxfuse

#################################

@joachimmetz joachimmetz self-assigned this Nov 21, 2018
@joachimmetz

This comment has been minimized.

Copy link
Member

@joachimmetz joachimmetz commented Nov 21, 2018

Thx for the report unfortunately I cannot deduce what is wrong based on the available information.

To troubleshoot ewfmount please compile with debug output. Also see: https://github.com/libyal/libewf/wiki/Troubleshooting#verbose-and-debug-output

Also please use the legacy version of libewf for production purposes (https://github.com/libyal/libewf-legacy)

@simsong

This comment has been minimized.

Copy link

@simsong simsong commented Jan 8, 2019

I am getting the same error on a clean install of MacOS 10.14.2. I have tried libewf-legacy but it does not compile. I'm happy to help debug. What do you need me to do?

@joachimmetz

This comment has been minimized.

Copy link
Member

@joachimmetz joachimmetz commented Jan 8, 2019

what can help is:

  • the version of "Fuse for macOS", what installation options were selected
  • a copy of config.log

I have tried libewf-legacy but it does not compile.

Could you be more specific. What did not work? What were error messages?

I see this info was added to: libyal/libewf-legacy#1, thx

@joachimmetz

This comment has been minimized.

Copy link
Member

@joachimmetz joachimmetz commented Jan 8, 2019

Based on: osxfuse/osxfuse#427 it appears that osxfuse 3.6.1 and later requires a volume icon and you'll need to specify one on mount:

The following works on my MacOS installation:

./ewftools/ewfmount -X volicon=/Library/Filesystems/osxfuse.fs/Contents/Resources/Volume.icns  image.ewf fuse/
@joachimmetz

This comment has been minimized.

Copy link
Member

@joachimmetz joachimmetz commented Jan 8, 2019

Per osxfuse/osxfuse#480 (comment)

The iconpath option is required when loading the volicon module at mount-time. 

I'll add this documentation, tracking this in libyal/libyal#73. Closing this issue.

@simsong

This comment has been minimized.

Copy link

@simsong simsong commented Jan 8, 2019

But what if you don't have an icon? Could there be a default?

@joachimmetz

This comment has been minimized.

Copy link
Member

@joachimmetz joachimmetz commented Jan 8, 2019

But what if you don't have an icon? Could there be a default?

The default ships as part of osxfuse: /Library/Filesystems/osxfuse.fs/Contents/Resources/Volume.icns

An UX improvement could be to detect if the volicon option is provide and set it to default icon if not. However this is a low-priority on my (very long) to do list.

@simsong

This comment has been minimized.

Copy link

@simsong simsong commented Jan 8, 2019

Ah. Would you like me to do this and send you a pull request?

@joachimmetz

This comment has been minimized.

Copy link
Member

@joachimmetz joachimmetz commented Jan 8, 2019

so the ewfmount tool is undergoing some heavy refactoring at the moment for dokany support. Then my focus for libewf will be to get an alpha release.

You can always send a PR that proposes adding the functionality but note that it will take some time to integrate them in to the master branch.

@simsong

This comment has been minimized.

Copy link

@simsong simsong commented Jan 8, 2019

Okay. I'll just tell my students that they need to provide the additional info. Thanks for your help!

@simsong

This comment has been minimized.

Copy link

@simsong simsong commented Jan 9, 2019

Your command did not work on my MacOS installation:

nimi:SanDisk Extreme simsong$ ewfinfo tracy-home-2012-07-16-final.E01
ewfinfo 20171104

Acquiry information
	Case number:		case_number
	Description:		Tracy's MacBook Air
	Examiner name:		examiner_name
	Evidence number:	evidence_number
	Notes:			Imaged on 2012-07-16 at 06:33:27 EST
	Acquisition date:	Mon Jul 16 09:33:27 2012
	System date:		Mon Jul 16 09:33:27 2012
	Operating system used:	Darwin
	Software version used:	20120603
	Password:		N/A

EWF information
	File format:		EnCase 6
	Sectors per chunk:	64
	Error granularity:	64
	Compression method:	deflate
	Compression level:	best compression

Media information
	Media type:		fixed disk
	Is physical:		yes
	Bytes per sector:	512
	Number of sectors:	36405120
	Media size:		17 GiB (18639421440 bytes)

Digest hash information
	MD5:			8e388fac32d4bcd7eb6d2f2cf95a73dc

nimi:SanDisk Extreme simsong$ sudo ewfmount -X volicon=/Library/Filesystems/osxfuse.fs/Contents/Resources/Volume.icns  tracy-home-2012-07-16-final.E01 /mnt
ewfmount 20171104

nimi:SanDisk Extreme simsong$ ls -l /mnt
ls: /mnt: No such file or directory
nimi:SanDisk Extreme simsong$ df -a /mnt
df: /mnt: No such file or directory
nimi:SanDisk Extreme simsong$ df -a
Filesystem                                            512-blocks       Used  Available Capacity iused               ifree %iused  Mounted on
/dev/disk1s1                                          1953595632 1901050568   42649872    98% 2167116 9223372036852608691    0%   /
devfs                                                        475        475          0   100%     822                   0  100%   /dev
/dev/disk1s4                                          1953595632    8389120   42649872    17%       3 9223372036854775804    0%   /private/var/vm
map -hosts                                                     0          0          0   100%       0                   0  100%   /net
map auto_home                                                  0          0          0   100%       0                   0  100%   /home
/dev/disk11s1                                           23027864   20213272    2750056    89%   29856 9223372036854745951    0%   /Volumes/farch
/dev/disk12s1                                         1953114032  244502888 1708206344    13%    2231 9223372036854773576    0%   /Volumes/SanDisk Extreme
com.apple.TimeMachine.2019-01-07-165732@/dev/disk12s1 1953114032  208120072 1708206344    11%    2679 9223372036854773128    0%   /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/nimi/2019-01-07-165732/SanDisk Extreme
ewfmount@osxfuse0                                              0          0          0   100%       0                   0  100%   /mnt
nimi:SanDisk Extreme simsong$ 

I will open a new ticket.

@joachimmetz

This comment has been minimized.

Copy link
Member

@joachimmetz joachimmetz commented Jan 9, 2019

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
3 participants
You can’t perform that action at this time.