Re: [sleuthkit-users] General file system error ($Data not found while loading the MFT)

[Brian C. <ca...@sl...>]

Hi Cristian,

What originally happened to the file system so that it needs  
rescuing?  That may answer why TSK is having problems.

thanks,
brian


On Jan 21, 2009, at 10:20 AM, Cristian Seres wrote:

> Hi!
>
> I am trying to rescue an NTFS file system with Sleuth Kit 2.09 (Helix
> Forensics). I have copied the hda1 partition to a file with Adepto  
> and I
> am getting "General file system error ($Data not found while  
> loading the
> MFT)".
>
> More information:
>
> #file hdc1-img.dd
> hdc1-img.dd: x86 boot sector, code offset 0x52, OEM-ID "NTFS    ",
> sectors/cluster 8, reserved sectors 0, Media descriptor 0xf8, heads  
> 255,
> hidden sectors 63, dos < 4.0 BootSector (0x80)
>
> #fsstat hdc1-img.dd
> Cannot determine file system type
> #fsstat -f ntfs hdc1-img.dd
> General file system error ($Data not found while loading the MFT)
>
> Do I need to use offset (how to calculate it?) or what am I doing  
> wrong?
>   How should I proceed to rescue the files?
>
> With best regards,
>
> -- 
> Cristian Seres
>
>
> ---------------------------------------------------------------------- 
> --------
> This SF.net email is sponsored by:
> SourcForge Community
> SourceForge wants to tell your story.
> http://p.sf.net/sfu/sf-spreadtheword
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org