How to handle dirty databases?

[jetProp445]

Hi Joachim,

I was wondering if libesedb can handle/open databases marked as dirt and if not how to handle errors in Python? Is there a complete list of errors pyesedb.open() can raise?

Regards,
Jerome

[joachimmetz]

I was wondering if libesedb can handle/open databases marked as dirt

yes, to a certain extent

Is there a complete list of errors pyesedb.open() can raise?

Primary IOError

libesedb display records marked as defunct

These are not exposed, see: #11

Defunct records are records deleted from the database

Defunct records are records that are deleted from a page table

e.g. records created in a private browsing session should be located in defunct records, right?

unsure, you'll need to test if these are stored at all

Defunct records are present until they are either overwritten with new data

yes

or the table tree is recalculated, right?

no

[jetProp445]

Thanks. I am trying to figure out how long values are stored in an ESE database using your code but since libesedb is quite big, it is very difficult. right now, it seems to me like the magic is not happening in libesedb_long_value.c. Could you point me to the relevant source code?

[joachimmetz]

@jetProp445 it is very hard for me to point you to the relevant source code if I don't have detailed context of what is going on.

If this is still an issue you send me debug output of the error you are observing. Also see:
https://github.com/libyal/libesedb/wiki/Troubleshooting#format-or-behavioral-errors

I'll close this issue for now, seeing it has been dormant for a while but will reopen if the issue still persists.