Repository: log2timeline/plaso

Issue #1495: IOError: [Errno 2] No such file or directory
Created: 2017-11-09T02:44:58Z
Plaso version:
log2timeline version 20171107
Operating system Plaso is running on:
Ubuntu 16.04.01 on VMWare Fusion on a MacBook.
Installation method:
Github Plaso and dependencies install directly.
Description of problem:
Running log2timeline.py against a mounted Encase volume (using ewfmount and mount commands),
after a while, it failed. Please see the filed message
I am running off SSD mounted as a SHARED folder into Fusion.
Also run another storage via Thunderbolt via Shared folder in Fusion, similar results.
All use to work before, but not the current version.
Debug output/tracebacks:
  File "/usr/local/bin/log2timeline.py", line 4, in <module>
    __import__('pkg_resources').run_script('plaso==20171107', 'log2timeline.py')
  File "/usr/local/lib/python2.7/dist-packages/pkg_resources/__init__.py", line 742, in run_script
    self.require(requires)[0].run_script(script_name, ns)
  File "/usr/local/lib/python2.7/dist-packages/pkg_resources/__init__.py", line 1503, in run_script
    exec(code, namespace, namespace)
  File "/usr/local/lib/python2.7/dist-packages/plaso-20171107-py2.7.egg/EGG-INFO/scripts/log2timeline.py", line 66, in <module>
    if not Main():
  File "/usr/local/lib/python2.7/dist-packages/plaso-20171107-py2.7.egg/EGG-INFO/scripts/log2timeline.py", line 52, in Main
    tool.ExtractEventsFromSources()
  File "/usr/local/lib/python2.7/dist-packages/plaso-20171107-py2.7.egg/plaso/cli/log2timeline_tool.py", line 597, in ExtractEventsFromSources
    worker_memory_limit=self._worker_memory_limit)
  File "/usr/local/lib/python2.7/dist-packages/plaso-20171107-py2.7.egg/plaso/multi_processing/task_engine.py", line 796, in ProcessSources
    storage_writer.WriteSessionCompletion(aborted=self._abort)
  File "/usr/local/lib/python2.7/dist-packages/plaso-20171107-py2.7.egg/plaso/storage/interface.py", line 1465, in WriteSessionCompletion
    self._storage_file.WriteSessionCompletion(session_completion)
  File "/usr/local/lib/python2.7/dist-packages/plaso-20171107-py2.7.egg/plaso/storage/zip_file.py", line 2723, in WriteSessionCompletion
    self.Flush()
  File "/usr/local/lib/python2.7/dist-packages/plaso-20171107-py2.7.egg/plaso/storage/zip_file.py", line 2386, in Flush
    self._WriteSerializedAttributeContainerList('event_source')
  File "/usr/local/lib/python2.7/dist-packages/plaso-20171107-py2.7.egg/plaso/storage/zip_file.py", line 1941, in _WriteSerializedAttributeContainerList
    offset_table.Write()
  File "/usr/local/lib/python2.7/dist-packages/plaso-20171107-py2.7.egg/plaso/storage/zip_file.py", line 533, in Write
    self._zip_file.writestr(self._stream_name, table_data)
  File "/usr/lib/python2.7/zipfile.py", line 1249, in writestr
    self.fp.write(bytes)
IOError: [Errno 2] No such file or directory```

Duplicate issue #1362: zipfile - IOError: [Errno 5] Input/output error
Created: 2017-08-20T07:39:14Z
Plaso version:
20170818
Ubuntu 16.04.2
Installation method:
Install GIFT and git clone development Plaso
Description of problem:
Processing E01 or mounted volumes (directory), error and stopped halfway through.
Debug output/tracebacks:
Traceback (most recent call last):
  File "/usr/local/bin/log2timeline.py", line 4, in <module>
    __import__('pkg_resources').run_script('plaso==20170818', 'log2timeline.py')
  File "/usr/local/lib/python2.7/dist-packages/pkg_resources/__init__.py", line 742, in run_script
    self.require(requires)[0].run_script(script_name, ns)
  File "/usr/local/lib/python2.7/dist-packages/pkg_resources/__init__.py", line 1503, in run_script
    exec(code, namespace, namespace)
  File "/usr/local/lib/python2.7/dist-packages/plaso-20170818-py2.7.egg/EGG-INFO/scripts/log2timeline.py", line 70, in <module>
    if not Main():
  File "/usr/local/lib/python2.7/dist-packages/plaso-20170818-py2.7.egg/EGG-INFO/scripts/log2timeline.py", line 56, in Main
    tool.ExtractEventsFromSources()
  File "/usr/local/lib/python2.7/dist-packages/plaso-20170818-py2.7.egg/plaso/cli/log2timeline_tool.py", line 600, in ExtractEventsFromSources
    worker_memory_limit=self._worker_memory_limit)
  File "/usr/local/lib/python2.7/dist-packages/plaso-20170818-py2.7.egg/plaso/multi_processing/task_engine.py", line 790, in ProcessSources
    storage_writer.WriteSessionCompletion(aborted=self._abort)
  File "/usr/local/lib/python2.7/dist-packages/plaso-20170818-py2.7.egg/plaso/storage/interface.py", line 1404, in WriteSessionCompletion
    self._storage_file.WriteSessionCompletion(session_completion)
  File "/usr/local/lib/python2.7/dist-packages/plaso-20170818-py2.7.egg/plaso/storage/zip_file.py", line 2743, in WriteSessionCompletion
    self.Flush()
  File "/usr/local/lib/python2.7/dist-packages/plaso-20170818-py2.7.egg/plaso/storage/zip_file.py", line 2326, in Flush
    self._WriteSerializedAttributeContainerList(u'event_source')
  File "/usr/local/lib/python2.7/dist-packages/plaso-20170818-py2.7.egg/plaso/storage/zip_file.py", line 1860, in _WriteSerializedAttributeContainerList
    offset_table.Write()
  File "/usr/local/lib/python2.7/dist-packages/plaso-20170818-py2.7.egg/plaso/storage/zip_file.py", line 549, in Write
    self._zip_file.writestr(self._stream_name, table_data)
  File "/usr/lib/python2.7/zipfile.py", line 1249, in writestr
    self.fp.write(bytes)
IOError: [Errno 5] Input/output error

Source data:
Tried both E01 original and after mounted E01 as directory. Same errors.

Closing comment (2017-11-27T06:53:33Z): Also seems to be a duplicate of #1495