OSForensic Error - "File not found"

[vlad.tsepesh]

Hi all,
while I was inspecting an HDD Windows OS, I'd like to look up the system32 directory against the "XP Pro (32-bit) hash set" downloaded from the website, just to be sure I'm in front of a well-know OS.
So I select the directory, left click and then choose the "Look up in hash set".
What I get is a popup reporting an error

\WINDOWS\system32\xxxx.dll is not accessible
File not found

enabling the DEBUGMODE the log says

Filename "xxxx.dll" found at MFT record 636 in INDEX_ROOT attribute.
Search btree direct: Could not find child node (dwRet=2)
Search btree direct exit

What goes wrong?

[David (PassMark)]

Was the file really called xxxx.dll? Or are you blanking out the real file name for some reason?

If you browse to this file in the file system browser and right click on the file and select properties, do you get the same error?

There is some chance it might be file system corruption.

[vlad.tsepesh]

Was the file really called xxxx.dll? Or are you blanking out the real file name for some reason?

yep, it supposed to be some sort of obfuscation

If you browse to this file in the file system browser and right click on the file and select properties, do you get the same error?

No error I get all the information.

Furthermore asking to look up in hash set, the same as before, I get a "No match found" but no error.

[keith]

yep, it supposed to be some sort of obfuscation



No error I get all the information.

Furthermore asking to look up in hash set, the same as before, I get a "No match found" but no error.

So just to clarify, when you try to look up the single file you get no error but when you look up the folder containing the file you get the error popup?

Deliberate obfuscation in your question probably isn't going to help find the problem.

[vlad.tsepesh]

So just to clarify, when you try to look up the single file you get no error but when you look up the folder containing the file you get the error popup?

Yes you get the point.

Deliberate obfuscation in your question probably isn't going to help find the problem.

the file name is "kbdsp.dll" but I don't think the name has any practical use.

[keith]

We've compiled a debug build that will output some additional debug statements. Can you run the following build in DEBUGMODE:

http://www.passmark.com/ftp/osf_V2.0.1003b.exe

You can send the log file to help[at]passmark[dot]com or paste the relevant parts here. Thanks.