libesedb.so undefined symbol

[Reginal Laurent]

Hello,

When i tried to import an NTDS file with the last version of BTA, i got the following error : /usr/local/lib/libesedb.so: undefined symbol: liberror_error_print.

Please, could you help me ?

Thank you so much.

Best regards, Regi

[Phil]

Hello,

This is due to the fact we developed against an older version of libesedb, that can be found here: http://pkgs.fedoraproject.org/repo/pkgs/libesedb/libesedb-alpha-20120102.tar.gz/198a30c98ca1b3cb46d10a12bef8deaf/libesedb-alpha-20120102.tar.gz

We will keep in sync with the latest version of the lib ASAP.

[Reginal Laurent]

Hello,

So, is it the older version of libesedb i have to use for resolving the error ?

Thank you.

Best regards, Regi

[Phil]

Correct! You have to use the 2012/01/02 alpha version for now.

[Reginal Laurent]

Thank you, it works now for me. Data is processing ...

[Reginal Laurent]

Hello,

Do i need a 64-bit OS ? I got the error : "mmap private failed with out of memory. You are using a 32 bit-bit build and probably need to upgrade to 64"

[Phil]

This message comes from mongo, which indeed prefers 64 bit systems.

[Phil]

Because of a rewrite, the latest versions of libesedb do not support so called "long values" yet. Hence we will stick to the old 2012 alpha version for the moment. The task is still open but stalled for now.

It becomes hard to find the old version, so I put it in our download section. Here it is: https://bitbucket.org/iwseclabs/bta/downloads/libesedb-alpha-20120102.tar.gz

[Yohann Lepage]

Did you test BTA against the latest version of libesedb ?

According to the changelog, some work has been done to support "long values" : https://github.com/libyal/libesedb/commit/35d374ac84fc3b2104714f3fd7e3bc1588dab257

Edit : the import of a random NTDIS.dit looks fine with libsesdb 20151213-1ppa1~trusty from https://launchpad.net/~gift/+archive/ubuntu/dev

[Phil]

Not yet but I'll have a try, hopefully soon. Thanks for the heads-up!