#137 4K FAT sectors don't seem to be supported.

[Brian Carrier]

From Thai Duong (April 2009)

Recently I acquired a removable USB thumb drive containing one single FAT32 file system which most of the tools in The Sleuth Kit fail to analyze it. As far as I know, the reason is this FAT32 file system uses a 4096-bytes sector, while The Sleuth Kit assumps a sector to be 512 bytes. Is it that the case? Please correct me if I'm wrong.

Since each sector is 4096-byte, the 510 and 511 bytes of the first sector don't contain the signagure 0x55AA. This makes tools like icat or istat stop working. When I write the signature to these two bytes, everything is working again except fsstat who keeps complaining:

FILE SYSTEM INFORMATION
--------------------------------------------
File System Type: FAT32

OEM Name: MSWIN4.1
Volume ID: 0x12345678
Volume Label (Boot Sector): NO NAME
Volume Label (Root Directory):
File System Type Label: FAT32
Error reading image file (tsk_fs_read_block: length 512 not a multiple of 4096) (fatfs_fsstat: TSK_FS_TYPE_FAT32 FSINFO block: 1)