Minor update.

ChangeLog

@@ -1,3 +1,9 @@
+Version: 1.0.0-beta20
+
+Minor update.
+
+---
+
 Version: 1.0.0-beta19
 
 Minor update.

ReadMe

@@ -8,7 +8,7 @@ dfir_ntfs: an NTFS parser for digital forensics & incident response
 
 2. Installation
 
-# pip3 install https://github.com/msuhanov/dfir_ntfs/archive/1.0.0-beta19.tar.gz
+# pip3 install https://github.com/msuhanov/dfir_ntfs/archive/1.0.0-beta20.tar.gz
 
 3. License
 

dfir_ntfs/LogFile.py

@@ -1664,7 +1664,12 @@ def get_lcns_for_page(self):
 
 		i = 0
 		while i < self.get_lcns_to_follow():
-			lcn = struct.unpack('<q', self.buf[32 + i * 8 : 40 + i * 8])[0]
+			lcn_buf = self.buf[32 + i * 8 : 40 + i * 8]
+			if len(lcn_buf) != 8:
+				raise ClientException('Invalid (truncated) log record length: {}'.format(len(self.buf)))
+
+			lcn = struct.unpack('<q', lcn_buf)[0]
+
 			lcns.append(lcn)
 
 			i += 1

dfir_ntfs/__init__.py

@@ -1,5 +1,5 @@
 # dfir_ntfs: an NTFS parser for digital forensics & incident response
 # (c) Maxim Suhanov
 
-__version__ = '1.0.0-beta19'
+__version__ = '1.0.0-beta20'
 __all__ = [ 'MFT', 'Attributes', 'WSL', 'USN', 'LogFile', 'BootSector', 'ShadowCopy', 'PartitionTable' ]

ntfs_parser

@@ -402,8 +402,12 @@ def process_log():
 			output_lines.append('Unknown offset in target')
 
 		lcns = []
-		for lcn in log_record.get_lcns_for_page():
-			lcns.append(str(lcn))
+		try:
+			for lcn in log_record.get_lcns_for_page():
+				lcns.append(str(lcn))
+		except LogFile.ClientException:
+			output_lines.append('Warning: truncated page')
+			return '\n'.join(output_lines)
 
 		if len(lcns) > 0:
 			output_lines.append('LCN(s): {}'.format(' '.join(lcns)))