ewfmount fuse3 error

[ormojo23]

Ewfmount using Fuse 3.10 on RHEL9 is throwing the following error:
lt-ewfmount: ../lib/fuse_opt.c:60: fuse_opt_add_arg: Assertion `!args->argv || args->allocated' failed.
Other libyal tools that attempt to fuse mount (vshadowmount, fshfsmount, bdemount) also throw this same error.

The E01 file used for testing: https://corp.digitalcorpora.org/corpora/drives/nps-2014-usb-non-deterministic/linux-dc3dd-first.E01

test system:
$ uname -a
Linux rhel 5.14.0-503.23.1.el9_5.x86_64 #1 SMP PREEMPT_DYNAMIC Mon Jan 20 10:19:28 EST 2025 x86_64 x86_64 x86_64 GNU/Linux
$ dnf list installed | grep fuse3
fuse3.x86_64 3.10.2-9.el9 @rhel-9-for-x86_64-appstream-rpms
fuse3-devel.x86_64 3.10.2-9.el9 @rhel-9-for-x86_64-appstream-rpms
fuse3-libs.x86_64 3.10.2-9.el9 @rhel-9-for-x86_64-appstream-rpms

$ ./ewfinfo ~/linux-dc3dd-first.E01
ewfinfo 20240827

Acquiry information:
Acquisition date: Tue May 27 14:53:25 2014
System date: Tue May 27 14:53:25 2014
Operating system used: Darwin
Software version used: 20131230
Password: N/A

EWF information:
File format: EnCase 6
Sectors per chunk: 64
Error granularity: 64
Compression method: deflate
Compression level: best compression
Set identifier: 09d6c7c1-3dec-714b-9b38-81606520597f

Media information:
Media type: fixed disk
Is physical: yes
Bytes per sector: 512
Number of sectors: 1972224
Media size: 963 MiB (1009778688 bytes)

Digest hash information:
MD5: 8296431a2ed42e32db84fa653c2122ca

[test@rhel ewftools]$ sudo ./ewfmount -X allow_other ~/linux-dc3dd-first.E01 /win
[sudo] password for test:
ewfmount 20240827

lt-ewfmount: ../lib/fuse_opt.c:60: fuse_opt_add_arg: Assertion `!args->argv || args->allocated' failed.
Aborted

[ormojo23]

one of the libfuse devs thinks this is due to not calling fuse_opt_add_arg properly: libfuse/libfuse#1127

[ormojo23]

I get the same error on Ubuntu 24.04.2 LTS, have I configured something wrong in the libewf build ?

[joachimmetz]

Thanks for the report I'll have a look when time permits.

If you can please attach your config.log to this issue as well.

On libfuse/libfuse#1127 I saw you stated "Google Libyal set of forensic parsing utilities".

Note that is NOT accurate.

• libyal is not affiliated with Google
• Not sure what you mean with "forensic parsing utilities", but (1) this project does not make such claims also see https://osdfir.blogspot.com/2020/09/testing-digital-forensic-data.html and (2) one could argue about the "forensic soundness" of the E01/L01 format

[ormojo23]

attached is the config.log from a RHEL9 system as that is my primary use case. And thank you for clarifying my mis-understanding of what libyal is (not)

rhel9.config.log