[sleuthkit-developers] [ sleuthkit-Bugs-2975613 ] 4K FAT sectors don't seem to be supported.

[SourceForge.net <no...@so...>]

Bugs item #2975613, was opened at 2010-03-23 20:40
Message generated for change (Tracker Item Submitted) made by carrier
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2975613&group_id=55685

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: File System Tools
Group: None
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Brian Carrier (carrier)
Assigned to: Nobody/Anonymous (nobody)
Summary: 4K FAT sectors don't seem to be supported.

Initial Comment:
>From Thai Duong (April 2009)

Recently I acquired a removable USB thumb drive containing one single FAT32 file system which most of the tools in The Sleuth Kit fail to analyze it. As far as I know, the reason is this FAT32 file system uses a 4096-bytes sector, while The Sleuth Kit assumps a sector to be 512 bytes. Is it that the case? Please correct me if I'm wrong.

Since each sector is 4096-byte, the 510 and 511 bytes of the first sector don't contain the signagure 0x55AA. This makes tools like icat or istat stop working. When I write the signature to these two bytes, everything is working again except fsstat who keeps complaining:

FILE SYSTEM INFORMATION
--------------------------------------------
File System Type: FAT32

OEM Name: MSWIN4.1
Volume ID: 0x12345678
Volume Label (Boot Sector): NO NAME    
Volume Label (Root Directory):
File System Type Label: FAT32   
Error reading image file (tsk_fs_read_block: length 512 not a multiple of 4096) (fatfs_fsstat: TSK_FS_TYPE_FAT32 FSINFO block: 1)



----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2975613&group_id=55685