[sleuthkit-developers] [ sleuthkit-Bugs-3023481 ] icat exporting error, FAT

[SourceForge.net <no...@so...>]

Bugs item #3023481, was opened at 2010-06-30 11:35
Message generated for change (Comment added) made by jlehr
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=3023481&group_id=55685

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: File System Tools
Group: None
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: John Lehr (jlehr)
Assigned to: Nobody/Anonymous (nobody)
Summary: icat exporting error, FAT

Initial Comment:
icat of any deleted file in a FAT16 partition only export 4kb of file.

The Sleuth Kit ver 3.1.3b1
Ubuntu 10.04

----------------------------------------------------------------------

>Comment By: John Lehr (jlehr)
Date: 2010-06-30 14:05

Message:
Correction, Fat32 Partition:

FILE SYSTEM INFORMATION
--------------------------------------------
File System Type: FAT32

OEM Name: MSDOS5.0
Volume ID: 0x861f3d71
Volume Label (Boot Sector): NO NAME    
Volume Label (Root Directory): CRUZER     
File System Type Label: FAT32   
Next Free Sector (FS Info): 90352
Free Sector Count (FS Info): 5609032

Sectors before file system: 63

File System Layout (in sectors)
Total Range: 0 - 15695441
* Reserved: 0 - 35
** Boot Sector: 0
** FS Info Sector: 1
** Backup Boot Sector: 6
* FAT 0: 36 - 15333
* FAT 1: 15334 - 30631
* Data Area: 30632 - 15695441
** Cluster Area: 30632 - 15695439
*** Root Directory: 30632 - 30639
** Non-clustered: 15695440 - 15695441

METADATA INFORMATION
--------------------------------------------
Range: 2 - 250636966
Root Directory: 2

CONTENT INFORMATION
--------------------------------------------
Sector Size: 512
Cluster Size: 4096
Total Cluster Range: 2 - 1958102


Further study shows that regular files are extracted correctly with icat
and the issue is limited to deleted files over 4.0 K.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=3023481&group_id=55685