{"action":"opened","issue":{"url":"https://api.github.com/repos/log2timeline/plaso/issues/429","labels_url":"https://api.github.com/repos/log2timeline/plaso/issues/429/labels{/name}","comments_url":"https://api.github.com/repos/log2timeline/plaso/issues/429/comments","events_url":"https://api.github.com/repos/log2timeline/plaso/issues/429/events","html_url":"https://github.com/log2timeline/plaso/issues/429","id":120844333,"number":429,"title":"Errors parsing an iPhone image","user":{"login":"dc3-plaso","id":12276043,"avatar_url":"https://avatars.githubusercontent.com/u/12276043?v=3","gravatar_id":"","url":"https://api.github.com/users/dc3-plaso","html_url":"https://github.com/dc3-plaso","followers_url":"https://api.github.com/users/dc3-plaso/followers","following_url":"https://api.github.com/users/dc3-plaso/following{/other_user}","gists_url":"https://api.github.com/users/dc3-plaso/gists{/gist_id}","starred_url":"https://api.github.com/users/dc3-plaso/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dc3-plaso/subscriptions","organizations_url":"https://api.github.com/users/dc3-plaso/orgs","repos_url":"https://api.github.com/users/dc3-plaso/repos","events_url":"https://api.github.com/users/dc3-plaso/events{/privacy}","received_events_url":"https://api.github.com/users/dc3-plaso/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-12-07T19:07:06Z","updated_at":"2015-12-07T19:07:06Z","closed_at":null,"body":"When I run log2timeline with an iPhone image using the following command:\r\n```\r\npython plaso/tools/log2timeline.py iPhone_out.dump iPhone.img -d --partition all\r\n```\r\n\r\nThis is a sample of the error output, which looks to be continuous for every file within the image:\r\n```\r\n\r\nProcessing started.\r\n2015-12-07 13:03:40,456 [DEBUG] (MainProcess) PID:5080 <extraction_frontend> Starting preprocessing.\r\n2015-12-07 13:03:40,542 [WARNING] (MainProcess) PID:5080 <manager> Unable to run preprocessor: MacOSXTimeZone for attribute: time_zone_str with error: Unable to find: /private/etc/localtime\r\n2015-12-07 13:03:40,568 [WARNING] (MainProcess) PID:5080 <manager> Unable to run preprocessor: MacOSXUsers for attribute: users with error: Unable to find user plist files.\r\n2015-12-07 13:03:40,700 [WARNING] (MainProcess) PID:5080 <manager> Unable to run preprocessor: MacOSXBuild for attribute: build with error: No such keys: ProductUserVisibleVersion.\r\n2015-12-07 13:03:40,742 [WARNING] (MainProcess) PID:5080 <manager> Unable to run preprocessor: MacOSXKeyboard for attribute: keyboard_layout with error: Unable to find: /Library/Preferences/com.apple.HIToolbox.plist\r\n2015-12-07 13:03:40,782 [WARNING] (MainProcess) PID:5080 <manager> Unable to run preprocessor: MacOSXHostname for attribute: hostname with error: Unable to find: /Library/Preferences/SystemConfiguration/preferences.plist\r\n2015-12-07 13:03:40,782 [DEBUG] (MainProcess) PID:5080 <extraction_frontend> Preprocessing done.\r\n2015-12-07 13:03:40,782 [INFO] (MainProcess) PID:5080 <extraction_frontend> Parser filter expression changed to: macosx\r\n2015-12-07 13:03:40,782 [DEBUG] (MainProcess) PID:5080 <extraction_frontend> Starting extraction in multi process mode.\r\n2015-12-07 13:03:40,782 [DEBUG] (MainProcess) PID:5080 <multi_process> Starting processes.\r\nWARNING:root:Unable to process path spec: type: OS, location: C:\\dev\\iPhone.img\r\ntype: RAW\r\ntype: TSK_PARTITION, location: /p1, part index: 4, start offset: 0x00008000\r\ntype: TSK, data stream: DATA, inode: 57154, location: /.file\r\n with error: Unable to open data stream: DATA.\r\nWARNING:root:Unable to process path spec: type: OS, location: C:\\dev\\iPhone.img\r\ntype: RAW\r\ntype: TSK_PARTITION, location: /p1, part index: 4, start offset: 0x00008000\r\ntype: TSK, data stream: DATA, inode: 16, location: /.journal\r\n with error: Unable to open data stream: DATA.\r\nWARNING:root:Unable to process path spec: type: OS, location: C:\\dev\\iPhone.img\r\ntype: RAW\r\ntype: TSK_PARTITION, location: /p1, part index: 4, start offset: 0x00008000\r\ntype: TSK, data stream: DATA, inode: 17, location: /.journal_info_block\r\n with error: Unable to open data stream: DATA.\r\nWARNING:root:Unable to process path spec: type: OS, location: C:\\dev\\iPhone.img\r\ntype: RAW\r\ntype: TSK_PARTITION, location: /p1, part index: 4, start offset: 0x00008000\r\ntype: TSK, data stream: DATA, inode: 60650, location: /^^^^HFS+ Private Data/iNode60650\r\n with error: Unable to open data stream: DATA.\r\nWARNING:root:Analyzer failed to determine compressed stream type indicators for file: TSK:/^^^^HFS+ Private Data/iNode60650 with error: pysigscan_scanner_scan_file_object: unable to scan file. pysigscan_file_object_read_buffer: unable to read from file object with error: 'File_read_random: (tsk3.c:494) Read error: Invalid file offset (tsk_fs_attr_read - 0)'.\r\nWARNING:root:Analyzer failed to determine archive type indicators for file: TSK:/^^^^HFS+ Private Data/iNode60650 with error: pysigscan_scanner_scan_file_object: unable to scan file. pysigscan_file_object_read_buffer: unable to read from file object with error: 'File_read_random: (tsk3.c:494) Read error: Invalid file offset (tsk_fs_attr_read - 0)'.\r\n\r\n...\r\n\r\nWARNING:root:Unable to process path spec: type: OS, location: C:\\dev\\iPhone.img\r\ntype: RAW\r\ntype: TSK_PARTITION, location: /p2, part index: 5, start offset: 0x55974000\r\ntype: TSK, data stream: DATA, inode: 433, location: /wireless/awdd/persistent.db\r\n with error: Unable to open data stream: DATA.\r\n2015-12-07 13:14:21,790 [DEBUG] (MainProcess) PID:2900 <processing_status> [ProcessingStatus] 120278 pathspecs produced, 119786 processed. 492 remaining. Extraction incomplete.\r\n2015-12-07 13:14:21,790 [DEBUG] (MainProcess) PID:2900 <processing_status> Processing incomplete, extraction still in progress.\r\n2015-12-07 13:14:21,790 [DEBUG] (MainProcess) PID:2900 <processing_status> [ProcessingStatus] 120278 pathspecs produced, 119786 processed. 492 remaining. Extraction incomplete.\r\nWorker_00 (PID: 556) - events extracted: 48128 - file: TSK:/wireless/awdd/staging - running: True <running>\r\nWorker_01 (PID: 3868) - events extracted: 48712 - file: TSK:/wireless/awdd/persistent.db - running: True <running>\r\nWorker_02 (PID: 1084) - events extracted: 47300 - file: TSK:/wireless/spool/MobileOriginated - running: True <running>\r\nWorker_03 (PID: 4008) - events extracted: 46648 - file: TSK:/wireless/spool/MobileOriginated/s.sms.1000000000 - running: True <running>\r\nWorker_04 (PID: 5996) - events extracted: 45976 - file: TSK:/wireless/spool/MobileOriginated/s.sms.1000000000:DATA - running: True <running>\r\nWorker_05 (PID: 4496) - events extracted: 43209 - file: TSK:/wireless/awdd/persistent.db:DATA - running: True <running>\r\n2015-12-07 13:14:30,318 [DEBUG] (MainProcess) PID:2900 <processing_status> Processing incomplete, extraction still in progress.\r\n```\r\n\r\nThis error appeared around the time data stream support was introduced. Before that, this same image was able to be parsed by log2timeline.\r\n\r\nPlease let me know if you would like me to pm you more logging information."}}