[sleuthkit-developers] [ sleuthkit-Bugs-3316603 ] TSK 3.2.2: icat/blkcat fail w/ RAW Mode2/Form1 ISO9660 image

[SourceForge.net <no...@so...>]

Bugs item #3316603, was opened at 2011-06-15 00:07
Message generated for change (Tracker Item Submitted) made by anarchivist
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=3316603&group_id=55685

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: File System Tools
Group: None
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Mark Matienzo (anarchivist)
Assigned to: Nobody/Anonymous (nobody)
Summary: TSK 3.2.2: icat/blkcat fail w/ RAW Mode2/Form1 ISO9660 image

Initial Comment:
I recently downloaded and built TSK 3.2.2 and I'm trying the functionality that was added in #3213888 to allow for reading of raw ISO9660 images created by software like FTK Imager. I'm seeing this issue only with disks that my imaging software claims were written using Mode 2/Form 1, and I'm seeing it on Sleuthkit that was built both on Mac OS X 10.6.7 and on Ubuntu 11.04.

Most of the file system tools like fls seem to work fine, but I am running into problems with icat and blkcat, in the form of an error like the following: 

Read offset too large for image file (tsk_img_read - [some value larger than file size]) (tsk_fs_file_walk: Error reading block at [block number])

I've attached a log using a sample raw image of a CD that was known written in Mode 2/Form 1.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=3316603&group_id=55685