Re: [sleuthkit-users] mmls and FAT12 partition question
Brought to you by:
carrier
Menu
▾
▴
Re: [sleuthkit-users] mmls and FAT12 partition question
|
From: Brian C. <ca...@sl...> - 2006-06-06 13:23:54
|
Floppy disks do not have partitions on them, but the signature value for FAT file systems and DOS partitions is the same (0xAAFF). Therefore, it is possible for a FAT file system to be interpreted as a DOS partition table, but the results do not typically make sense (as you observed). You could have also run fdisk on the image and gotten the same results. The latest version of TSK added some more sanity checks and would not have printed these results. It checks to make sure that the partitions start in the image file (and the partitions in this case are much larger than a floppy). You could simply run 'fls' on the image to list the files using TSK. brian js wrote: > Hi list, > > I have a dd image of a floppy. > > when examining this floppy with the disktype command I get: > >> disktype floppy1.001 >> >> --- floppy1.001 >> Regular file, size 1.406 MiB (1474560 bytes) >> FAT12 file system (hints score 5 of 5) >> Volume size 1.390 MiB (1457664 bytes, 2847 clusters of 512 bytes) > > When I want to list the partitions on this image i do: > >> mmls floppy1.001 >> DOS Partition Table >> Sector: 0 >> Units are in 512-byte sectors >> >> Slot Start End Length Description >> 00: ----- 0000000000 0000000000 0000000001 Primary Table (#0) >> 01: ----- 0000000001 1112359496 1112359496 Unallocated >> 02: 00:01 1112359497 1651347857 0538988361 Novell Netware (0x65) >> 03: 00:02 1126178899 1126198689 0000019791 Win LVM / Secure >> FS (0x42) >> 04: ----- 1126198690 1869562399 0743363710 Unallocated >> 05: 00:00 1869562400 3503645331 1634082932 GoBack (0x44) > > When I want some extra info about this FAT12 disk I do: > This also confirms its a FAT12. >> dosfsck -v floppy1.001 >> dosfsck 2.11 (12 Mar 2005) >> dosfsck 2.11, 12 Mar 2005, FAT32, LFN >> Checking we can access the last sector of the filesystem >> Boot sector contents: >> System ID "IBM 3.3" >> Media byte 0xf0 (5.25" or 3.5" HD floppy) >> 512 bytes per logical sector >> 512 bytes per cluster >> 1 reserved sector >> First FAT starts at byte 512 (sector 1) >> 2 FATs, 12 bit entries >> 4608 bytes per FAT (= 9 sectors) >> Root directory starts at byte 9728 (sector 19) >> 224 root directory entries >> Data area starts at byte 16896 (sector 33) >> 2847 data clusters (1457664 bytes) >> 18 sectors/track, 2 heads >> 0 hidden sectors >> 2880 sectors total >> Checking for unused clusters. >> floppy1.001: 1 files, 0/2847 clusters > > > When I check how many space there is left on the disk I get : > >> df -h >> Filesystem Size Used Avail Use% Mounted on >> /dev/floppy/0 1.4M 51K 1.4M 4% /mnt/floppy > > I can list the contents of this disk, no problem. > > > Where does the information that mmls produces come from? > Why can I read the disk without any problems on my linux box and windows > box? > How can the OS handle this disk since the partition layout is completely > wrong? > > > Thanks in advance list, > > Js. > > > > _______________________________________________ > sleuthkit-users mailing list > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users > http://www.sleuthkit.org |