Re: [sleuthkit-users] Problems with NTFS image from FAU's dd

[Jan M. <jan...@nr...>]

Hello Brian,

thanks for the super quick reply.
> How big is the disk image?  How big was the original disk?  What OS / 
> distro are you on?
>
The image is ca. 76GB, and it's an 80GB disk

I'm running this on FreeBSD 6.2 in a VMWare.

> The read() call is returning the "Argument list too long" error string 
> and that does not make sense for the read() call. There still seems to 
> be some 32-bit versus 64-bit issues with TSK 2.51 on older Linux 
> systems, so I wonder if that is playing a role here.
>
Is that a literal read() on an opened file descriptor that returns 
"Argument list too long"?
I can totally whip out gdb and have a look if you can tell me the 
name(s) of the function(s) to break at.

Hm...meanwhile, should I try it on Linux? Think this may be OS-related?

Thanks again,

Jan

-- 
Jan Muenther, CTO Security, n.runs AG