Error when executing SIDR in Windows 24H2 and 25H2 #11
Description
When running SIDR as shown next (WSEARCH is a directory holding WSEARCH SQLite 3 databases) under Win11 / 24H2 OS Build 26100.6899), an error ocurs.
sidr.exe -f csv -r to-file -o A-CSV WSEARCH
Processing sqlite: WSEARCH\Windows.db
sqlite_get_hostname() failed: Empty field System_ComputerName. Will use 'Unknown' as a hostname.
A-CSV\Unknown_File_Report_20251112_205919.288525700.csv
A-CSV\Unknown_Internet_History_Report_20251112_205919.289094700.csv
A-CSV\Unknown_Activity_History_Report_20251112_205919.289472700.csv
(output with RUST_BACKTRACE=full)
thread 'main' panicked at 'called Result::unwrap() on an Err value: TryFromSliceError(())', C:\Users\kasto.cargo\git\checkouts\ese_parser-b1822da59468068b\b007503\lib\src\ese_parser.rs:530:45
stack backtrace:
0: 0x7ff7b118332c -
1: 0x7ff7b11973bb -
2: 0x7ff7b117fc29 -
3: 0x7ff7b11830db -
4: 0x7ff7b1185139 -
5: 0x7ff7b1184def -
6: 0x7ff7b118563e -
7: 0x7ff7b118552d -
8: 0x7ff7b1183ca9 -
9: 0x7ff7b1185230 -
10: 0x7ff7b1272a75 -
11: 0x7ff7b1272ea3 -
12: 0x7ff7b11212cb -
13: 0x7ff7b110e17e -
14: 0x7ff7b110b78b -
15: 0x7ff7b1116227 -
16: 0x7ff7b1116c7f -
17: 0x7ff7b10ed27f -
18: 0x7ff7b10ed2c4 -
19: 0x7ff7b1179dc8 -
20: 0x7ff7b1119dec -
21: 0x7ff7b126cab4 -
22: 0x7fff64bbe8d7 - BaseThreadInitThunk
23: 0x7fff659ac53c - RtlUserThreadStart
-
The only CSV file with data (file_report) with the last entry having the largest pathname (179 chars).
-
The error also occurs in other Windows 11 (one was 25h2) with other wsearch database.