[sleuthkit-developers] [ sleuthkit-Bugs-2645156 ] FAT16 slack space not collected by blkls

[SourceForge.net <no...@so...>]

Bugs item #2645156, was opened at 2009-02-27 07:17
Message generated for change (Settings changed) made by carrier
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2645156&group_id=55685

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
>Category: File System Tools
Group: None
>Status: Closed
>Resolution: Fixed
Priority: 5
Private: No
Submitted By: Charlie Daly (charliedaly)
>Assigned to: Brian Carrier (carrier)
Summary: FAT16 slack space not collected by blkls

Initial Comment:

blkls (Sleuth Kit ver 3.0.1) does not correctly collect slack space from a particular  FAT16 partition.

Image: http://polya.computing.dcu.ie/FATimage.dd
of a virtual 1G drive and a FAT16 partition. There are a few directories and files.

The command

blkls -s -o 63 FATimage | xxd -a | less

does not correctly collect the slack space.

Using dls (Sleuth Kit ver 2.52) does collect the slack space correctly.

Highest regards,
Charlie

----------------------------------------------------------------------

>Comment By: Brian Carrier (carrier)
Date: 2009-05-05 23:37

Message:
allocsize set too small and then found issues with special files not being
properly reset.  Fix checked into trunk:

Sending        trunk/CHANGES.txt
Sending        trunk/tsk3/fs/dls_lib.c
Sending        trunk/tsk3/fs/fatfs_dent.c
Sending        trunk/tsk3/fs/fatfs_meta.c
Sending        trunk/tsk3/fs/fs_attr.c
Sending        trunk/tsk3/fs/fs_dir.c
Transmitting file data ......
Committed revision 91.


----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2645156&group_id=55685