TypeError: unsupported operand type(s) for *: 'NoneType' and 'int'

[fr0nk]

I tried recovering files of an image made from a very badly defective hard disk. I got the following error (with a few lines of previous output):

DEBUG:root:Found MATCH in positions set([212032]) with weight 5 (55.5555555556%)
INFO:root:Finalizing MFT reconstruction of partition at offset 206848
INFO:root:Adding extra attributes from $ATTRIBUTE_LIST
INFO:root:Adding ghost entries from $INDEX_ALLOCATION
DEBUG:root:Found MATCH in positions set([32073856]) with weight 3 (42.8571428571%)
INFO:root:Finalizing MFT reconstruction of partition at offset 206848
INFO:root:Adding extra attributes from $ATTRIBUTE_LIST
INFO:root:Adding ghost entries from $INDEX_ALLOCATION
DEBUG:root:Found MATCH in positions set([27858496]) with weight 2 (66.6666666667%)
INFO:root:Finalizing MFT reconstruction of partition at offset 206848
INFO:root:Adding extra attributes from $ATTRIBUTE_LIST
INFO:root:Adding ghost entries from $INDEX_ALLOCATION
INFO:root:Finalizing MFT reconstruction of partition at offset 206848
INFO:root:Adding extra attributes from $ATTRIBUTE_LIST
Traceback (most recent call last):
  File "main.py", line 309, in <module>
    main()
  File "main.py", line 291, in main
    parts.update(scanner.get_partitions())
  File "/home/mint/RecuperaBit/recuperabit/fs/ntfs.py", line 835, in get_partitions
    self.finalize_reconstruction(part)
  File "/home/mint/RecuperaBit/recuperabit/fs/ntfs.py", line 668, in finalize_reconstruction
    self.add_from_attribute_list(parsed, part, node.offset)
  File "/home/mint/RecuperaBit/recuperabit/fs/ntfs.py", line 623, in add_from_attribute_list
    _integrate_attribute_list(parsed, part, image)
  File "/home/mint/RecuperaBit/recuperabit/fs/ntfs.py", line 242, in _integrate_attribute_list
    real_pos = mft_pos + index * FILE_size
TypeError: unsupported operand type(s) for *: 'NoneType' and 'int'

[Lazza]

This is hard to diagnose without having the chance to analyze that specific disk. Could you please try to run the program again after replacing ntfs.py with this version? It will still crash but it will print useful debug information that I need to see.

ntfs.py.txt

[fr0nk]

Thanks for the reply, I will do that as soon as I get a hold of the image again and update you.

[Lazza]

Did you manage to have a look?

[fr0nk]

Sorry, it will still take a while until I get the image, as it's not from my own computer. As soon as I have it I will proceed with testing.

[qazuor]

Hi, I have the same error. I use the ntfs.py modified version, and this is the last lines of the output:

INFO:root:Found NTFS file record at sector 733854378
INFO:root:Found NTFS file record at sector 734056674
INFO:root:Found NTFS file record at sector 734258970
INFO:root:Found NTFS index record at sector 762969088
INFO:root:Found NTFS index record at sector 909772464
INFO:root:Found NTFS boot sector at sector 936773631
INFO:root:First scan completed
INFO:root:Saving results to /media/qazuor/LG External HDD/backup/scanfile
INFO:root:Parsing MFT entries
INFO:root:Parsing INDX records
INFO:root:Reading boot sectors
DEBUG:root:Dropping bogus NTFS partition with MFT position 16 generated by MFT mirror of partition at offset 0
DEBUG:root:Dropping bogus NTFS partition with MFT position 247123554 generated by MFT mirror of partition at offset 247118392
DEBUG:root:Dropping bogus NTFS partition with MFT position 3359258 generated by MFT mirror of partition at offset 3354096
DEBUG:root:Dropping bogus NTFS partition with MFT position 10573866 generated by MFT mirror of partition at offset 10568704
DEBUG:root:Dropping bogus NTFS partition with MFT position 10681618 generated by MFT mirror of partition at offset 10676456
INFO:root:Finding partition geometry
INFO:root:Finalizing MFT reconstruction of partition at offset 0
INFO:root:Adding extra attributes from $ATTRIBUTE_LIST
Traceback (most recent call last):
  File "app_main.py", line 72, in run_toplevel
  File "main.py", line 309, in <module>
    main()
  File "main.py", line 291, in main
    parts.update(scanner.get_partitions())
  File "/home/qazuor/Desktop/systemrescuecd-x86-4.9.0/RecuperaBit-master/recuperabit/fs/ntfs.py", line 842, in get_partitions
    self.finalize_reconstruction(part)
  File "/home/qazuor/Desktop/systemrescuecd-x86-4.9.0/RecuperaBit-master/recuperabit/fs/ntfs.py", line 675, in finalize_reconstruction
    self.add_from_attribute_list(parsed, part, node.offset)
  File "/home/qazuor/Desktop/systemrescuecd-x86-4.9.0/RecuperaBit-master/recuperabit/fs/ntfs.py", line 630, in add_from_attribute_list
    _integrate_attribute_list(parsed, part, image)
  File "/home/qazuor/Desktop/systemrescuecd-x86-4.9.0/RecuperaBit-master/recuperabit/fs/ntfs.py", line 245, in _integrate_attribute_list
    logging.error("MFT_pos: " + mft_pos)
TypeError: unsupported operand type(s) for +: 'str' and 'int'
qazuor@NOSE4 ~/D/s/RecuperaBit-master> 

[Lazza]

Woops, I am sorry. Apparently there is an error in the debug version of ntfs.py. Lines starting from 245 should print the data after converting it to strings:

logging.error("MFT_pos: " + str(mft_pos))
logging.error("Index: " + str(index))
logging.error("num: " + str(num))
logging.error("entries_by_type: " + str(entries_by_type))

Sorry for the trouble. I am attaching a new file for debugging purposes.

ntfs.py.txt

[qazuor]

Ok. I change the lines (because attached version is the same of previous attached files).

This are the last output lines:

INFO:root:Adding extra attributes from $ATTRIBUTE_LIST
INFO:root:Adding ghost entries from $INDEX_ALLOCATION
DEBUG:root:Found MATCH in positions set([17464168]) with weight 2 (66.6666666667%)
INFO:root:Finalizing MFT reconstruction of partition at offset 0
INFO:root:Adding extra attributes from $ATTRIBUTE_LIST
INFO:root:Adding ghost entries from $INDEX_ALLOCATION
DEBUG:root:Found MATCH in positions set([13250176]) with weight 4 (26.6666666667%)
INFO:root:Finalizing MFT reconstruction of partition at offset 0
INFO:root:Adding extra attributes from $ATTRIBUTE_LIST
INFO:root:Adding ghost entries from $INDEX_ALLOCATION
DEBUG:root:Found MATCH in positions set([157433320]) with weight 2 (22.2222222222%)
INFO:root:Finalizing MFT reconstruction of partition at offset 71898144
INFO:root:Adding extra attributes from $ATTRIBUTE_LIST
INFO:root:Adding ghost entries from $INDEX_ALLOCATION
DEBUG:root:Found MATCH in positions set([13319664]) with weight 2 (100.0%)
INFO:root:Finalizing MFT reconstruction of partition at offset 0
INFO:root:Adding extra attributes from $ATTRIBUTE_LIST
INFO:root:Adding ghost entries from $INDEX_ALLOCATION
DEBUG:root:Found MATCH in positions set([145696, 145704, 145744, 145736]) with weight 2 (100.0%)
DEBUG:root:Found MATCH in positions set([241493408, 241493440, 241493528, 241493488, 241493464, 241493480, 241493512, 241493416, 241493424, 241493448, 241493520, 241493496, 241493456, 241493472, 241493504, 241493432]) with weight 2 (13.3333333333%)
DEBUG:root:Found MATCH in positions set([241493576, 241493584, 241493592]) with weight 2 (13.3333333333%)
DEBUG:root:Found MATCH in positions set([241493568, 241493584, 241493576, 241493552, 241493592, 241493560]) with weight 2 (13.3333333333%)
DEBUG:root:Found MATCH in positions set([241493504, 241493536, 241493576, 241493584, 241493560, 241493512, 241493520, 241493544, 241493568, 241493592, 241493552, 241493528]) with weight 2 (13.3333333333%)
DEBUG:root:Found MATCH in positions set([10852608, 10852640, 10852720, 10852696, 10852616, 10852712, 10852656, 10852624, 10852648, 10852736, 10852784, 10852800, 10852792, 10852672, 10852632, 10852704]) with weight 2 (18.1818181818%)
DEBUG:root:Found MATCH in positions set([324976]) with weight 14 (100.0%)
INFO:root:Finalizing MFT reconstruction of partition at offset 0
INFO:root:Adding extra attributes from $ATTRIBUTE_LIST
ERROR:root:MFT_pos: 273381856
ERROR:root:Index: None
ERROR:root:num: 6619256
ERROR:root:entries_by_type: {6619256: set([None]), 6357092: set([4456517])}
qazuor@NOSE4 ~/D/s/RecuperaBit-master> 

Sorry by my english, is not so good.

[Lazza]

Great, this is exactly what I needed.

[Lazza]

@qazuor could you test if it works for you now? I wrote the code and the logic seems to work but I cannot test it on a real drive because it didn't happen to me.

Thank you.

[qazuor]

Hi @Lazza.

Yes It work fine now!
Thanks you very much!
I recovered several important files thanks to your tool. :D