pyevtx-rs icon indicating copy to clipboard operation
pyevtx-rs copied to clipboard

`RuntimeError: Failed to parse record number <num>`. Skip over in iterator if possible.

Open GlasierXplor opened this issue 2 years ago • 0 comments

Firstly, would just want to say that the library is great and really fast for use in code -- thank you.

However, in my use the iterator ran into an issue and the error message was simply: - "RuntimeError: Failed to parse record number 6116193" and the iterator will stop parsing the EVTX file further.

The EVTX file was not corrupted as far as I am aware, and I believe this is an extreme edge case, considering that no one opened an issue on this.

Would like to ask for either: -

  • More detailed error messages (i.e. why did it fail to parse), and/or
  • A message to indicate that the record was skipped (either as part of the JSON or a non-fatal error) and the iterator would not stop parsing the EVTX file (I think missing 1 line out of a few million others is an okay compromise)

Hopefully you'll be able to look into this.

Thank you - Tim

GlasierXplor avatar May 13 '22 07:05 GlasierXplor