ValueError: Can't resolve blob if blob dir is not set

[seychelles111]

Hey I am working with some people, but some people move.
there is a thing, that IT people, just delete everything in the chats you had done... but I need to refer to old messages in teams. (One more reason to keep main Mmm )

When running the script I encounter the ValueError: Can't resolve blob if blob dir is not set.

Is it possible, I can use the tools some how ?

[seychelles111]

openned it on sleuthkit/autopsy#7881

sorry

[seychelles111]

channel-roster-version-store Teams:channel-info-pane-manager:fb37c808-6ca7-40eb-8746-85795efcbd36:8:orgid:246d6ad6-b7ca-477a-a94d-caa5a0b8ab42 (Records: 0)
infoPaneInternalDataStore Teams:channel-info-pane-manager:fb37c808-6ca7-40eb-8746-85795efcbd36:8:orgid:246d6ad6-b7ca-477a-a94d-caa5a0b8ab42 (Records: 0)
app-entitlements Teams:channel-installed-apps-manager:fb37c808-6ca7-40eb-8746-85795efcbd36:246d6ad6-b7ca-477a-a94d-caa5a0b8ab42 (Records: 0)
app-definitions Teams:channel-installed-apps-manager:fb37c808-6ca7-40eb-8746-85795efcbd36:246d6ad6-b7ca-477a-a94d-caa5a0b8ab42 (Records: 0)
app-entitlements Teams:chat-installed-apps-manager:fb37c808-6ca7-40eb-8746-85795efcbd36:246d6ad6-b7ca-477a-a94d-caa5a0b8ab42 (Records: 0)
app-definitions Teams:chat-installed-apps-manager:fb37c808-6ca7-40eb-8746-85795efcbd36:246d6ad6-b7ca-477a-a94d-caa5a0b8ab42 (Records: 0)
Traceback (most recent call last):
File "C:\Users\anon\Documents\teams archive\forensicsim\tools\dump_leveldb.py", line 68, in
process_cmd()
File "C:\Users\anon\AppData\Local\Programs\Python\Python311\Lib\site-packages\click\core.py", line 1157, in call
return self.main(*args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\Users\anon\AppData\Local\Programs\Python\Python311\Lib\site-packages\click\core.py", line 1078, in main
rv = self.invoke(ctx)
^^^^^^^^^^^^^^^^
File "C:\Users\anon\AppData\Local\Programs\Python\Python311\Lib\site-packages\click\core.py", line 1434, in invoke
return ctx.invoke(self.callback, **ctx.params)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\Users\anon\AppData\Local\Programs\Python\Python311\Lib\site-packages\click\core.py", line 783, in invoke
return __callback(*args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\Users\anon\Documents\teams archive\forensicsim\tools\dump_leveldb.py", line 64, in process_cmd
process_db(filepath, outputpath)
File "C:\Users\anon\Documents\teams archive\forensicsim\tools\dump_leveldb.py", line 39, in process_db
extracted_values = parse_db(input_path, do_not_filter=True)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\Users\anon\AppData\Local\Programs\Python\Python311\Lib\site-packages\forensicsim\backend.py", line 75, in parse_db
extracted_values.append({
File "C:\Users\anon\AppData\Local\Programs\Python\Python311\Lib\site-packages\chromedb\ccl_chromium_indexeddb.py", line 846, in iterate_records
yield from self._raw_db.iterate_records(
File "C:\Users\anon\AppData\Local\Programs\Python\Python311\Lib\site-packages\chromedb\ccl_chromium_indexeddb.py", line 641, in iterate_records
precursor = self.read_record_precursor(
^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\Users\anon\AppData\Local\Programs\Python\Python311\Lib\site-packages\chromedb\ccl_chromium_indexeddb.py", line 600, in read_record_precursor
blob = self.get_blob(db_id, store_id, key.raw_key, externally_serialized_blob_index).read()
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\Users\anon\AppData\Local\Programs\Python\Python311\Lib\site-packages\chromedb\ccl_chromium_indexeddb.py", line 692, in get_blob
raise ValueError("Can't resolve blob if blob dir is not set")
ValueError: Can't resolve blob if blob dir is not set
PS C:\Users\anon\Documents\teams archive\forensicsim>

[seychelles111]

cclgroupltd/ccl_chromium_reader#20

[cclgroupltd]

This doesn't look like a problem with the underlying library - it should be expected that record data is also found in the .blob folder. @lxndrblz are you picking up the blob folder as well as the leveldb folder?

[lxndrblz]

@cclgroupltd Thanks for pointing the correct way. Currently, the parser does not take into account the .blob folder and doesn't pass it it to the library.

This should be a fairly easy fix to implement, as it is merely, passing the path as a parameter.

[lxndrblz]

@seychelles111 I have cleaned up your issue a little bit as there was a lot of contradicting information (Microsoft Firewall doesn't have to do anything with the module or its functionality, nor can I relate how this should be a memory issue).

[lxndrblz]

openned it on sleuthkit/autopsy#7881

sorry

Please close this issue, as it is not the appropriate place to discuss.