services - NotImplementedError

[reynas]

Setup:
I have 16 E01 images, created with FTK imager on a live system.
Out of these 16, I have 2 machines that result in a "Not implementedError", which stops the processing entirely and not continuing with "the next in line".
The hives, while dirty, can be read with RegistryExplorer without replay and the services can be read

• NotImplementedError: b'\x89b'

• NotImplementedError: b'\xf6\xd3'

  I can share the full output if necessary. Unfortunately, I cannot share the hives. But I'm of course willing to help troubleshoot this issue!

  This is small snippet of one of the errors:
  `╭─────────────────────────────────────────── locals ───────────────────────────────────────────╮ │

  │ │ data = b'\xf6\xd3\xb9\x01\x01\x00\x00\x80\x18\x8bJ\x98\x00\x00\x00\x00\x01\x00\x00\x00\xcb\… │ │

  │ │ self = <dissect.regf.regf.RegistryHive object at 0x7646ef7950f0> │ │

  │ │ sig = b'\xf6\xd3' │ │

  │ ╰──────────────────────────────────────────────────────────────────────────────────────────────╯ `

[EinatFox]

Hi @reynas thanks for pointing this out to us. We had a look and indeed the error handling should be more resilient and not stop processing in such failures.

[Horofic]

@reynas could you share the full output in advance? You can share it here if appropriate. Else we have to come up with an alternative way of sharing the stacktrace

[reynas]

dissect-services-error.txt