Re: [Libguestfs] Hivex - Trailing garbage at the end of hive file

(Resending since my message from 2 days ago didn't make it to the list. Perhaps because of the log file attachment) Hi Rich, Sorry about the delayed response. I understand that since hive formats are not open, the current tack of warning about the hive file is a better one To respond to you question about "whether it fails", hivexsh is unable to open the hive file and it prints this message and exits. I've attached the verbose logs as requested This extract from the logs shows that the hivexsh complains content after file offset 0x77c000 is garbage hivex: badsys: trailing garbage at end of file (at 0x77c000, after 1849 pages) So, I went ahead and truncated the contents of the file after that file offset and hivex was able to successfully open the new hive file The sizes of the different hive files shown here [root@ip-10-66-209-246 ~]# ls -als bads* 7664 -rw--w--w- 1 root root 7847936 Oct 1 21:51 badsys (SYSTEM hive file after truncating trailing garbage) 7680 -rw------- 1 root root 7864320 Oct 1 21:21 badsysback (original SYSTEM hive file) 16 -rw-r--r-- 1 root root 16384 Oct 1 21:55 badsysgarb (16K of truncated garbage) Looking into hive file, the last 16K is what hivex complains to be trailing garbage. All of that 16K is zeroes. [root@ip-10-66-209-246 ~]# dd if=./badsysback of=./badsysgarb bs=4k skip=1916 4+0 records in 4+0 records out 16384 bytes (16 kB) copied, 9.1288e-05 s, 179 MB/s [root@ip-10-66-209-246 ~]# hexdump badsysgarb 0000000 0000 0000 0000 0000 0000 0000 0000 0000 * 0004000 I'm not sure what the filesystem cluster size is but could the SYSTEM hive file be padded with 16K of zeroes to match 32k cluster allocation (or something like that?) I imported both hive files (original one that hivex complained about and the truncated one) into a windows regedit and the tool opened them both fine and showed pretty much the same content I'm going to see if the hive file I have has any sensitive customer information and will try to share it if it does not Thanks for you help! ~ Hari On 9/25/13 4:59 AM, "Richard W.M. Jones" <rjones(a)redhat.com&gt; wrote: