110 Character Burne...
 
Notifications
Clear all

110 Character Burner Software Limitation

9 Posts
4 Users
0 Likes
613 Views
(@akaplan0qw9)
Posts: 69
Trusted Member
Topic starter
 

I have been using FTK as the underpinning of my analyses and augmenting the FTK with other data as necessary. FTK permits a detailed HTML report that is organized and accessed with hyperlinks. I like it and for the mostpart it works very well. After the report is generated I burn it to a CD or DVD, depending on the size, and distribute it to the client.

I use HP RecordNow for both the CD and DVD burners. It works well for the most part. However, it will not burn "files" longer than 110 characters. The strings that it is rejecting are a part of the evidence and can neither be trucated or dropped. The items I am having trouble with are coming from the SUBJECT's activity on the internet. For example,

http://www.forensicfocus.com/index.php?name=Forums&file=posting&mode=newtopic&f=4

This string is only 81 characters long, but you get the idea.

I guess the easiest thing would be to get burner spftware without that limitation.

Anybody have a suggestion?

 
Posted : 11/01/2005 5:14 pm
(@gmarshall139)
Posts: 378
Reputable Member
 

FTK has some nice features, one of them being the report wizard, but there are a few problems, and you found one here.

The problem you are experiencing is due to the file system used to burn the cd or dvd. It's not that the file is too long, just the name. When you select "export files" in the report wizard it creates the file in a subdirectory under your report but creates a new file name including the full path of the file. This can create a very long filename indeed. With NTFS or FAT32 (common pc file systems) you can have file names up to 255 characters. Common cd and DVD file systems do not allow this many characters. There are several file systems used in cd and dvd's.

ISO 9660: filename is limited to 8 characters and a 3 character extension
Joliet: Filenames may be up to 64 characters and include spaces, this is usually the default for cd burning
UDF: supports up to 255 character file names

Change the file system on your buring software to UDf. On easy cd creator it's under the file menu then select "cd project properties". Yours should be similiar. I say that, but when I tested it my version of easy cd creator, which is an older version, it still prompted me that I was exceeding the allowed file name length of 64 characters, which does not apply to the UDF file system. My only explanation here is that my software is not taking advantages of UDF's capabilities. Yours may be different.

Perhaps someone else on this board will have experience with a cd burner which takes advantage of the long filename capabilities of the UDF file system.

Easy CD Creator gives the option to change the file names, either to something designated by the user, or automatically, but this would mess up the report, as the links in the html document would no longer work.

I cannot find a method for altering the file names as created by the export process of FTK. At least not when they are exported automatically as part of the report wizard. When exporting files manually the block "prepend archive name to file name" can be unchecked. The exported file would then bear the same file name in it's exported location as it had originally. I would take this issue up with Access Data. They may have already fixed the problem, I am using an older version of FTK. Regardless of whether or not the files can be properly burned to a cd, I would prefer that they had their original file names.

 
Posted : 11/01/2005 7:33 pm
(@akaplan0qw9)
Posts: 69
Trusted Member
Topic starter
 

<<Regardless of whether or not the files can be properly burned to a cd, I would prefer that they had their original file names>>

I agree. I can visualize the difficulty one would have trying to justify changing an original file name.

In the past, I have sometimes been careful to limit the number of characters in the resident (FTK) path. For Example I named one case "JB". When one is small, you can get away with that, although it is not good. In spite of that, some of those original strings are too long to make cut without surgery.

I talked to HP sales today about the character limitation. The salesperson and I noted that the URL of the HP page we were on just barely made the cut. If "Hewlitt Packard" had not changed their name to "HP" that URL would have been kicked. In any case, the software is manufactured by Sonic. They appear to have made a number of changes and upgrades to RecordNow. Hopefully, one of those allows one to take advantage of the UDF capability. I put the problem to their sales staff, but have not yet gotten a response.

 
Posted : 12/01/2005 3:05 am
(@gmarshall139)
Posts: 378
Reputable Member
 

Al,

Don't throw out that software yet. I posed this question on the Encase board and was told that Sonic had addressed this issue. The new version is 7.2. Did you find anyplace where you could change the file system to UDF?

 
Posted : 14/01/2005 8:35 pm
(@akaplan0qw9)
Posts: 69
Trusted Member
Topic starter
 

Greg,

I bought the 7.2 Deluxe RecordNow. It does not seem to have solved the problem. Rather, there appear to be two problems. let me get to that in a moment. First of all, they say very little about UDF. The following is all I could find and I'm not sure what it means.


File system notes:
Microsoft Joliet has been used since Windows 95. This system can handle file names up to 106 characters.
Choose ISO+Joliet to make a disc readable by as many computers as possible.
Use ISO Level 2 only if you are familiar with this file system type.
The DVD file system is preset to ISO+Joliet+UDF. It cannot be changed.

I burned a report on a DVD. The default (presumably ISO+Joliet+UDF) gave me a number of rejects for exceeding 110 characters. I switched to the (ISO+Joliet) and saw that not all the files were being kicked because of the length problem. Many were being kicked because the file names contained illegal DOS file name characters (/, \, etc.) . The file names in question all seemed to be temporary Internet files dealing with sports betting. I've been wondering if someone had deliberately trapped those files so that they could not be copied easily or if they just got corrupted. I finally opted for the ISO+Joliet because it appeared to promise more readability and the (ISO+Joliet+UDF) did not appear to cure the 110 limit problem. I'm going to see what Sonic has to say about this.

The best news came from FTK which promises to put some sort of a truncate button in the report generator, that would enable the examiner to substitute a truncated path on the examining computer. That is in the works and may be in the next update (don't hold your breath). Obviouly, that would solve many of the long file problems, but will not solve all.

FTK support gave me a fix that I have not yet tried. They suggest I zip the report in Windows and burn it to a CD or DVD. It will not auto play, but I can add an Auto Play utility that opens to an instruction telling the client how to unzip the report to his computer. It is sort of Mickey Mouse and I don't like it, but at least it maintains the integrity of the report.

This problem has not occurred all the time and I'm not sure why, but at least a part of it has to have come from me not paying attention to the number of directories I stick in the path as well as the names given to my image drives. If I pay attention, I should be able to cut at least 10 characters.

 
Posted : 15/01/2005 1:46 am
(@gmarshall139)
Posts: 378
Reputable Member
 

The only real solution would have to come from FTK. It's just not practical to have a filename over 100 characters. We use descriptive file names as well when doing online investigations. Maybe 60 characters at most. It makes it really difficult to see the end (which is often the unique part) of the file names in a normal explorer window.

Record Now is apparently burning the disk with multiple file systems so it can be viewed by someone using windows 95 as well as someone viewing with xp, various versions of linux, or even dos. Not a bad idea, particularly for our application. I don't like the idea of a zip file either, the more foolproof the report the better. I don't have any experience with FTK, but this can't be the first time this has come up.

 
Posted : 17/01/2005 1:55 pm
(@akaplan0qw9)
Posts: 69
Trusted Member
Topic starter
 

<<this can't be the first time this has come up.>>

I'm sure that's true. When I brought it up, she not only understood the problem, sha had some apparent insight into a fix being in the works.

 
Posted : 17/01/2005 4:52 pm
(@bitbucket)
Posts: 6
Active Member
 

Hi

Anybody get a solution to this problem yet?

I've just checked out Sonic RecordNow. It appears that while it may burn CDs in long file name mode now, the burning to a DVD is limited to 106 characters – even though you can select ISO Level 2 as an option.

Nero 6 appears to be the same – long file or folder names (up to 200+ chars) on CD burning, but not DVD.

Sonic RecordNow in the help file says the DVD file system is fixed at ISO+Joliet+UDF – is that Sonic restriction, or something else?

TIA

 
Posted : 04/08/2005 11:38 am
(@member)
Posts: 22
Eminent Member
 

ISO 9660 filename is limited to 8 characters and a 3 character extension
Joliet Filenames may be up to 64 characters and include spaces, this is usually the default for cd burning
UDF supports up to 255 character file names

Change the file system on your buring software to UDf.

ya, these are standards (n considering easy usability there seems very less you could do. (unless you are willing to make a compressed self extracting archive (exe) of the report, make it autorun with a diag whether your client want to extract to a location or view the report via %temp%

FTK support gave me a fix that I have not yet tried. They suggest I zip the report in Windows and burn it to a CD or DVD. It will not auto play, but I can add an Auto Play utility that opens to an instruction telling the client how to unzip the report to his computer. It is sort of Mickey Mouse and I don't like it, but at least it maintains the integrity of the report.

i suppose you are conservative abt renaming as you have to manually edit the hyperlinks etc? how about EXPORTING THE WHOLE BUNCH OF HTMLs to a PDF (or chm/lit?) file builder & giving the report in CHM/PDF/LIT format etc.

 
Posted : 15/10/2006 8:16 pm
Share: