Issue running on SIFT: ModuleNotFoundError: No module named 'construct' about indxripper

[harelsegev]

INDXRipper doesn't support the EWF format. Use ewfmount on your image, and it will create a file INDXRipper can work with.
This video may help: https://www.youtube.com/watch?v=3S-joLMbDGo

The offset you provide should be in sectors. If 2048 is the offset in sectors, you don't need to multiply it by 512.
Let me know if that solved your problem!

[ezaspy]

Thanks, but this didn't solve my problem. I have mounted the image successfully using ewfmount:

sudo ewfmount /mnt/hgfs/testing/Disk1/Disk1.E01 /mnt/ewf_mount99

And I receive a different error:

python3.9 ../tools/INDXRipper/INDXRipper.py /mnt/ewf_mount/ewf1 outfile

Traceback (most recent call last):
  File "../tools/INDXRipper/INDXRipper.py", line 12, in <module>
    from ntfs import parse_filename_attribute, get_resident_attribute, get_attribute_name, get_attribute_type
  File "../tools/INDXRipper/ntfs.py", line 7, in <module>
    from construct import (
ModuleNotFoundError: No module named 'construct'

Please note, I have previously run (I am assuming the construct module is likely causing the issue):

pip install construct==2.10.68
python3.9 -m pip install construct==2.10.68

[harelsegev]

This is super weird, because the import didn't fail when you executed it against the E01 image.
Are you sure you installed construct in the same interpreter you executed the tool with?

[ezaspy]

Yes, absolutley sure. I'm using Ubuntu 20.04 (no venv, just base OS) and have installed construct for both python3.8 and python3.9, respectively:
python3.8

pip install construct==2.10.68

python3.9

python3.9 -m pip install construct==2.10.68

[harelsegev]

I would try opening the Python 3.9 interpreter and typing import construct, just to make sure it's really installed.
I'm not sure what the problem is, but it doesn't seem like it's in my code. I don't know how to help you.

[ezaspy]

Please see attached the confirmation of installation. Are you able to replicate it at all?

[harelsegev]

I think I figured this out. You use sudo to exeucte INDXRipper.py, and that's why the interpreter cannot find the module.
Read this: https://askubuntu.com/questions/1268870/python-module-not-found-in-sudo-mode-ubuntu-20-04

Just don't use sudo, and it should work fine:

If you do want to execute it as root, you can create a virtualenv:

git clone https://github.com/harelsegev/INDXRipper.git
cd INDXRipper
python3.9 -m virtualenv venv
source venv/bin/activate
pip install construct==2.10.68
sudo venv/bin/python INDXRipper.py "/mnt/ewf_mount/ewf1" ../outfile.csv

Again, not a problem in my code.

EDIT: You should probably use virtualenv. I updated the installation section in the README, check it out.

[ezaspy]

Yep - you solved it. Thanks!