index out of range

[thedeepaxe]

Hello,

Using the following:
./analyzeMFT.py -f ../Downloads/C/$MFT

I am getting this error:

Traceback (most recent call last):
File "/home/kari/analyzeMFT/./analyzeMFT.py", line 21, in
session.process_mft_file()
File "/home/kari/analyzeMFT/analyzemft/mftsession.py", line 189, in process_mft_file
self.build_filepaths()
File "/home/kari/analyzeMFT/analyzemft/mftsession.py", line 281, in build_filepaths
record = mft.parse_record(raw_record, self.options)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/kari/analyzeMFT/analyzemft/mft.py", line 68, in parse_record
atr_record = decode_atr_header(raw_record[read_ptr:])
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/kari/analyzeMFT/analyzemft/mft.py", line 621, in decode_atr_header
(d['ndataruns'], d['dataruns'], d['drunerror']) = unpack_dataruns(s[64:])
^^^^^^^^^^^^^^^^^^^^^^^
File "/home/kari/analyzeMFT/analyzemft/mft.py", line 660, in unpack_dataruns
bit_len = bitparse.parse_little_endian_signed(datarun_str[pos:pos + lengths.b.lenlen])
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/kari/analyzeMFT/analyzemft/bitparse.py", line 36, in parse_little_endian_signed
value |= buf[i] << (i * 8)
~~~^^^
IndexError: index out of range

[badr-boukari]

The same problem here using the following:
$python2 ../Tools/analyzeMFT/analyzeMFT.py -o fs-mft-29-05-2024.csv -f mft-after --bodyfull

python2 -V ===> Python 2.7.18

Or even:
$python3 ../Tools/analyzeMFT/analyzeMFT.py -o fs-mft-29-05-2024.csv -f mft-after --bodyfull

python3 -V ===> Python 3.8.10

[mwalkowski]

I have prepared a PR fixing this bug #63

[rowingdude]

Greetings, I merged @mwalkowski's fix. This was a planned fix in the next release. Thank you for your help!