Appearance
Most BitCurator problems are environment problems, not tool bugs: a device that the virtual machine cannot see, a disk that auto-mounted read-write, or a memory-starved scanner. Diagnose in that order. Confirm the source is visible and write-protected, confirm the image is valid, then look at the individual tool. This guide works through the failures that actually slow archivists down day to day and gives the specific fix for each, rather than restating the BitCurator manual.
Why can't BitCurator see my media?
The single most common blocker is device pass-through. BitCurator runs as a VirtualBox guest, and by default the host keeps your USB writer, card reader or floppy controller to itself. Fix it once:
bash
# On the host, add yourself to the VirtualBox USB group, then log out/in
sudo usermod -aG vboxusers $USERThen install the VirtualBox Extension Pack, and in the VM choose Devices then USB and tick the exact device. If a floppy controller such as a Greaseweazle still does not appear, attach its USB controller rather than the drive node.
Why does Guymager report the source as writable?
Imaging must read from a write-protected source, so Guymager warns when the disk is mounted read-write. Either the host auto-mounted it or the guest did. Unmount and verify:
bash
mount | grep sdb # find the offending mount
sudo umount /dev/sdb1 # release it
# Confirm BitCurator's read-only policy is engaged before re-scanning
cat /etc/udev/rules.d/*readonly* 2>/dev/nullThe reliable answer is a hardware write blocker; the software read-only policy is a backstop, not a guarantee.
Why is bulk_extractor crawling or crashing?
bulk_extractor is memory-hungry, and a large image with every scanner enabled will exhaust a default VM. Three levers help, in order of impact:
bash
bulk_extractor \
-G 16M \ # larger page size, fewer passes
-x wordlist -x exif \ # drop scanners you do not need
-o be_out image.E01Then raise the VM's RAM allocation; 8 GB is a sensible floor for multi-gigabyte images. If it still dies, split the image and scan segments.
Why won't my disk image mount?
A split or compressed EWF image is not a loopback file. Reassemble it first, or read it without mounting at all using The Sleuth Kit, which understands the image directly:
bash
# List partitions without mounting
mmls image.E01
# Read the file listing from a partition at sector offset 2048
fls -o 2048 image.E01When you do need a real mount, convert EWF to raw with ewfexport, then mount -o ro,loop. Never mount read-write.
A quick error-to-fix reference
| Symptom | Likely cause | Fix |
|---|---|---|
| Device missing in VM | No USB pass-through | Extension Pack + vboxusers + attach device |
| "Source is writable" | Auto-mounted disk | Unmount; use write blocker |
| bulk_extractor OOM | RAM-starved VM | More RAM, -G, -x unused scanners |
| Image won't mount | Split/compressed EWF | ewfexport to raw, or use Sleuth Kit |
| Empty report | Upstream fiwalk failed | Check logs; confirm file system identified |
How do you confirm a clean run end to end?
Treat the BitCurator Reporting tool as a check, not the work. If it emits empty output, an earlier step produced nothing for it to summarise, usually fiwalk failing to recognise the file system. Read the working-directory logs, confirm the image was identified, and only then re-run the report. A good run leaves you a DFXML file, a bulk_extractor feature set and a human-readable report that all agree on the same image.
Key Takeaways
- Diagnose in order: device visibility, write protection, then the specific tool.
- Solve pass-through once with the Extension Pack and the vboxusers group.
- Guymager's "writable source" warning means unmount or write-block first.
- Tame bulk_extractor with more RAM, a larger page size and fewer scanners.
- Read images with The Sleuth Kit when loop-mounting fails.
- An empty report signals an upstream failure; check the logs before re-running.
Frequently Asked Questions
Why does my USB drive not appear in the BitCurator VM?
VirtualBox does not pass the device through by default. Install the Extension Pack, add your user to the vboxusers group, then attach the device under Devices then USB, choosing the specific drive.
Why does Guymager say the source is mounted read-write?
The host or guest auto-mounted the disk. Unmount it, confirm the BitCurator read-only policy is active, or use a hardware write blocker, then refresh Guymager before acquiring.
Why is bulk_extractor extremely slow or running out of memory?
Large images with many scanners enabled exhaust RAM. Increase the VM's allocated memory, raise the page size with -G, and disable scanners you do not need with -x to cut runtime sharply.
Why won't a disk image mount for browsing?
The image may be split, compressed EWF, or use a file system Linux cannot read directly. Reassemble or convert it, then loop-mount read-only, or use The Sleuth Kit tools that read the image without mounting.
Why did the BitCurator Reporting tool produce empty output?
It usually means an upstream step failed silently, such as a fiwalk run that found no recognised file system. Check the logs in the working directory and confirm the image was identified before re-running the report.
Should I run BitCurator on bare metal or in a VM?
A VM is fine for most work and keeps your host clean, but allocate generous RAM and disk, and pass through USB controllers carefully. Bare metal helps only for very large images or heavy bulk_extractor jobs.