ajnelson / sleuthkit

The Sleuth Kit (TSK) is a library and collection of command line digital forensics tools that allow you to investigate volume and file system data. The library can be incorporated into larger digital forensics tools and the command line tools can be directly used to find evidence.
http://www.sleuthkit.org/sleuthkit/
1 stars 0 forks source link

XTAF partitions are being called FAT{16,32} by fsstat #4

Closed ajnelson closed 11 years ago

ajnelson commented 11 years ago

ajnelson@guile:/corpus/xbox360$ fsstat -o 8782848 DRIVE.aff

FILE SYSTEM INFORMATION

File System Type: FAT16 Serial number: [snip] Volume Label (Root Directory):

File System Layout (in sectors) Total Range: 0 - 488397167 Total Range in Image: 0 - 479614319

ajnelson@guile:/corpus/xbox360$ fsstat -o 9205120 DRIVE.aff

FILE SYSTEM INFORMATION

File System Type: FAT16 Serial number: [snip] Volume Label (Root Directory):

File System Layout (in sectors) Total Range: 0 - 488397167 Total Range in Image: 0 - 479192047

ajnelson@guile:/corpus/xbox360$ fsstat -o 9467264 DRIVE.aff

FILE SYSTEM INFORMATION

File System Type: FAT16 Serial number: [snip] Volume Label (Root Directory):

File System Layout (in sectors) Total Range: 0 - 488397167 Total Range in Image: 0 - 478929903

ajnelson@guile:/corpus/xbox360$ fsstat -o 9991552 DRIVE.aff

FILE SYSTEM INFORMATION

File System Type: FAT32 Serial number: [snip] Volume Label (Root Directory):

File System Layout (in sectors) Total Range: 0 - 488397167 Total Range in Image: 0 - 478405615

ajnelson commented 11 years ago

The partitions should instead be called "XTAF16" or "XTAF32".