Description of problem: Sleuthkit 4.1.3 cannot deal with exFAT. All SD and uSD cards from 64GB upwards (as used as expansion cards in phones and tablets and more importantly: memory cards of digital cameras, where 64GB is not uncommon anymore) are formatted and usable with other systems only formatted as exFAT. Especially to rescue digital photos that are deleted, the sleuthkit is critical. Version-Release number of selected component (if applicable): Sleuthkit 4.2.0 has exFAT support. Reproducible: Steps to Reproduce:
(In reply to Rob Teng from comment #0) > Description of problem: > Sleuthkit 4.1.3 cannot deal with exFAT. > sleuthkit-4.2.0-1.mga6 is available in cauldron. However, I'll assign to the maintainer, in case it is possible to backport that version to Mga5
Keywords: (none) => BackportCC: (none) => marja11Assignee: bugsquad => pmdenielouSource RPM: (none) => sleuthkit
As I have updated sleuthkit for Cauldron I can update it for mga5 as an update (not a backport), does anybody have an objection?
CC: (none) => geiger.david68210
(In reply to David GEIGER from comment #2) > As I have updated sleuthkit for Cauldron I can update it for mga5 as an > update (not a backport), does anybody have an objection? One man's bug fix might be another man's new feature, but I think everything new in 4.2.0 can be considered as a bug fix https://github.com/sleuthkit/sleuthkit/blob/sleuthkit-4.2.0/NEWS.txt It would then be fine according to our updates policy https://wiki.mageia.org/en/Updates_policy#Version_Policy so no objection from me.
Hi Rob Teng, Well! package sleuthkit-4.2.0 is now submitted and uploaded on mga5/Core/Updates_testing repo, can you try if all is fine with this update, please?
Hi all, thanks a lot for your actions. David, I managed to install (first turned on the updates_testing repo, somehow it couldn't find sleuthkit 4.2.0 so I just got it and the missing dependencies from the jussieu mirror) and run it, unfortunately it doesn't seem to function. I first tried with an image: # fls bigcard.ddimg -i raw -f exfat Invalid magic value (Error: sector size (0) is not a multiple of device size (512) Do you have a disk image instead of a partition image?) Then with the actual card (device): # fls /dev/sdd1 -f exfat -i raw Invalid magic value (Error: sector size (0) is not a multiple of device size (512) Do you have a disk image instead of a partition image?) I also tried without "-i raw" and with /dev/sdd, and the error stays the same. Without "-f exfat" it tells me that it cannot determine the file system type. Note: this card works fine in my photo camera, and to read photos from on the same machine with the same card reader. I also tried an 8GB uSDHC card, which works fine with: fls /dev/sdd1 So at least there's that. If you have any ideas on what I could try, please let me know. Thanks again!
No sorry I have no idea :( perhaps you can see directly with upstream for that to get more info on this new feature and how it should be used. So this update works as it should or not?
Hi David, I guess you could say it works as it should as far as we can tell - the programs don't fail to run... Thanks again to all and feel free to close.
So ok! Assigning to QA, Advisory: ============================= Current version of sleuthkit is nearly 2 years old, so this updates sleuthkit to a version which is supported upstream, also it fixes various bug and it adds ExFAT support. https://github.com/sleuthkit/sleuthkit/blob/sleuthkit-4.2.0/NEWS.txt ============================= Packages in 5/core/updates_testing: ======================== sleuthkit-4.2.0-1.mga5.i586.rpm sleuthkit-4.2.0-1.mga5.x86_64.rpm libtsk13-4.2.0-1.mga6.i586.rpm lib64tsk13-4.2.0-1.mga6.x86_64.rpm libtsk-devel-4.2.0-1.mga6.i586.rpm lib64tsk-devel-4.2.0-1.mga6.x86_64.rpm Source RPM: ======================== sleuthkit-4.2.0-1.mga5.src.rpm
Assignee: pmdenielou => qa-bugs
Keywords: Backport => (none)Component: Backports => RPM Packages
CC: (none) => davidwhodginsWhiteboard: (none) => advisory
What *is* exFAT ? FAT32 ? NTFS ? Can this be tried with (say) a USB stick, or USB disc, of the appropriate format; or does it really need an SD type memory card >=64Gb ?
CC: (none) => lewyssmith
exFAT was introduced around 2006 by Microsoft. Itâs a file system optimized for flash drives. Itâs designed to be a lightweight file system like FAT32 without all NTFSâs extra features and overhead, but without FAT32âs limitations. No 4GB ceiling. To work with exfat in Mageia you need to have installed exfat-utils and fuse-exfat. These are not GPL type apps and are thus in the Tainted repositories. Most linux disk programs can read and recognize exfat but only some will allow you to create it. examples.. gparted will Not allow you to create exfat partiotns gnome-disks Will allow to create it
CC: (none) => cae
On top of the above explanation: Microsoft has managed to have their way with SDXC media (>=64GB SD cards, most popular for digital cameras, in micro-SD shape also for mobile phones): they must be formatted with exFAT, or they are not conform SDXC. And, since the exFAT is relatively new, the patent is valid (FAT was about to expire). So now they can get license fees for all digital cameras and all mobile phones with support for >=64 GB cards.
As discussed last week. This is a new version which happens to add the functionality rather than a patch being added to support it. As such we can assume it does what it says it does and trust upstream QA processes. It's sufficient for us to ensure the package updates cleanly with no obvious regressions in basic operation. Rob, which architecture (i586/x86_64) did you test on please?
I tested on x86-64 (AMD Kaveri A10-7800 CPU).
Thanks
Whiteboard: advisory => advisory mga5-64-ok
Validating.
Keywords: (none) => validated_updateCC: (none) => sysadmin-bugs
An update for this issue has been pushed to the Mageia Updates repository. http://advisories.mageia.org/MGAA-2016-0068.html
Status: NEW => RESOLVEDResolution: (none) => FIXED