Segment file extensions for large number of segments

[p4xel]

Just came across EX01 image of 6TB drive split into 2GB segments. Number of files exceeded counter for implemented extensions.
Then image I was dealing had extension Tx01. The numbering went as follows

Tx01-Tx99
TxAA-TxZZ
TyAA-TyZZ
TzAA-TzZZ
T{AA-T{ZZ

(it wasnt T{ZZ, and I don't have the image any more, and also cannot verify what's next)
libewf failed to mount the full image, as it could not load extensions pass TzZZ)

There is a good chance we can encounter this issue soon as storage sizes grow rapidly.

[joachimmetz]

@p4xel thx for the report, the reason for libewf not supporting past TzZZ is that the behavior was not defined in the format specification (if I recall correctly). I'll see if I can reproduce it with an awful small segment file size.

There is a good chance we can encounter this issue soon as storage sizes grow rapidly.

This makes me wonder, why still use segment files (split images) in the first place? most removable media is a thing from the past IMHO

[chrestme]

Just piping in that I'm currently experiencing this exact issue. I have approximately 2500 2GB segment files for an image of a 6TB drive, with extensions beginning Ex01, and breaking on E{AA. The error traceback points to "libewf_filename_set_extension: unable to support for more segment files."

I'll try commenting out those specific checks in libewf_filename.c and recompile to see how it behaves.

[joachimmetz]

@chrestme can you describe which segment file extensions you are observing

[chrestme]

The image is comprised of 2474 segment file with extensions of:
Ex01-Ex99
EyAA-EyZZ
EzAA-EzZZ
E{AA...

I was actually trying to load them in X-Ways, and I got an error naming segment file 2129, which corresponds to where the filename extensions transition to E{AA.

For what it's worth, I commented out the checks in libewf_filename_set_extension and recompiled, and was able to successfully run ewfmount, and nothing seemed to blow up.

[joachimmetz]

What comes after E{ZZ ?

[chrestme]

I'm not sure. I think they're just incrementing the value after E, so after Ez (0x7a) is E{ (0x7b), it would seem the next value would be E| (0x7c).

…

On Fri, Aug 11, 2023 at 11:47 PM Joachim Metz ***@***.***> wrote: What comes after E{ZZ ? — Reply to this email directly, view it on GitHub <#148 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABRCSGEQYFFS7XANELQXDTLXU34GLANCNFSM4ZZYYNZA> . You are receiving this because you were mentioned.Message ID: ***@***.***>