search

ajnelson / sleuthkit

The Sleuth Kit (TSK) is a library and collection of command line digital forensics tools that allow you to investigate volume and file system data. The library can be incorporated into larger digital forensics tools and the command line tools can be directly used to find evidence.
http://www.sleuthkit.org/sleuthkit/
1 stars 0 forks source link

tsk_loaddb is reporting a FATFS label during magic check #18

Closed ajnelson closed 11 years ago

ajnelson commented 11 years ago

Sample output:

tsk_loaddb -d DRIVE.db DRIVE.aff 
Error: Invalid magic value (Not a FATFS file system (magic)) (TskAutoDb::addFsInfoUnalloc: error opening fs at offset 4496818176)
Error: Invalid magic value (Not a FATFS file system (magic)) (TskAutoDb::addFsInfoUnalloc: error opening fs at offset 4713021440)
Error: Invalid magic value (Not a FATFS file system (magic)) (TskAutoDb::addFsInfoUnalloc: error opening fs at offset 4847239168)
Error: Invalid magic value (Not a FATFS file system (magic)) (TskAutoDb::addFsInfoUnalloc: error opening fs at offset 5115674624)
ajnelson commented 11 years ago

New error output after fixing issue 12, which was based on a bad fat/xtaf detector:

Error: Invalid API argument (xtaffs_getFAT: invalid cluster address: 13196) (TskAutoDb::addFsInfoUnalloc: error walking fs unalloc blocks, fs id: 5)
Error: Invalid API argument (xtaffs_getFAT: invalid cluster address: 8192) (TskAutoDb::addFsInfoUnalloc: error walking fs unalloc blocks, fs id: 48)
Error: Invalid API argument (xtaffs_getFAT: invalid cluster address: 16383) (TskAutoDb::addFsInfoUnalloc: error walking fs unalloc blocks, fs id: 71)
Error: Invalid API argument (xtaffs_getFAT: invalid cluster address: 14946527) (TskAutoDb::addFsInfoUnalloc: error walking fs unalloc blocks, fs id: 87)

These messages all pop out at the end (that is, in the last second).

ajnelson commented 11 years ago

As of cd277f12a34a1133826d3e02e11a368ce140db34, that new error output is confirmed a separate issue.