ewfacquire fails to image one specific thumb drive

[gregfreemyer]

I have successfully imaged other thumb drives so this is not a generic issue.

With a specific thumb drive I am trying to image ewfacquire is failing. The thumbdrive itself is operational and I can image it via dc3dd.

ewfacquire /dev/sdb
ewfacquire 20140608

Device information:
Unable to print media information.
libsmdev_string_trim_copy_from_byte_stream: string too small.
libsmdev_internal_handle_determine_media_information: unable to set serial number.
libsmdev_handle_get_bus_type: unable to determine media information.
device_handle_media_information_fprint: unable to retrieve bus type.
Unable to retrieve media type from device.
libsmdev_string_trim_copy_from_byte_stream: string too small.
libsmdev_internal_handle_determine_media_information: unable to set serial number.
libsmdev_handle_get_media_type: unable to determine media information.
device_handle_get_media_type: unable to retrieve media type.

The thumb drive is a generic one.

l don't know if it is helpful, but "lsusb -v -s" gives this detail

Bus 004 Device 003: ID 13fe:5500 Kingston Technology Company Inc.
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 3.00
bDeviceClass 0 (Defined at Interface level)
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 9
idVendor 0x13fe Kingston Technology Company Inc.
idProduct 0x5500
bcdDevice 1.00
iManufacturer 1
iProduct 2 Patriot Memory
iSerial 3
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 44
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 0
bmAttributes 0x80
(Bus Powered)
MaxPower 126mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 8 Mass Storage
bInterfaceSubClass 6 SCSI
bInterfaceProtocol 80 Bulk-Only
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0400 1x 1024 bytes
bInterval 0
bMaxBurst 3
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x02 EP 2 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0400 1x 1024 bytes
bInterval 0
bMaxBurst 3
Binary Object Store Descriptor:
bLength 5
bDescriptorType 15
wTotalLength 22
bNumDeviceCaps 2
USB 2.0 Extension Device Capability:
bLength 7
bDescriptorType 16
bDevCapabilityType 2
bmAttributes 0x00000002
Link Power Management (LPM) Supported
SuperSpeed USB Device Capability:
bLength 10
bDescriptorType 16
bDevCapabilityType 3
bmAttributes 0x00
wSpeedsSupported 0x000e
Device can operate at Full Speed (12Mbps)
Device can operate at High Speed (480Mbps)
Device can operate at SuperSpeed (5Gbps)
bFunctionalitySupport 2
Lowest fully-functional device speed is High Speed (480Mbps)
bU1DevExitLat 10 micro seconds
bU2DevExitLat 2047 micro seconds
Device Status: 0x0000
(Bus Powered)

[joachimmetz]

Greg, thanks for reporting this. Looks like the device_handle is being picky and stops ewfacquire when it does not get the right data. I'll have a look when I can.

[joachimmetz]

Moved to: libyal/libsmdev#2