Re: [sleuthkit-users] Question regarding keyword search

[Brian C. <bca...@at...>]

> >> Is it just the unallocated space or all of the
> >>partition?
> 
> As far as I can tell, I'm searching the entire partition. The page is
> titled "Keyword search on images/hdb1 - which is the name of the
> image.

This is true.  You can also just search the unallocated space by
using the 'Extract Unallocated Space' button on the bottom.
 
> I left the defaults with regard to Strings file etc. However, when I
> unchecked
> the MD5 options, in an effort to speed searching, 

The initial MD5 check value will have no impact on the speed of the
process.  The MD5 only takes longer when the image is initially
imported.

> I got the same error in
> the
> LHS frame : "Error identifying block size (dcat -s output)", and of course
> no results.

The error is on the left-hand side now?  That is very strange, since it
means that sometimes it works and sometimes it doesn't.  The errors last
night were on the right-hand side correct?

> No, I repeated the search for Linda, and got a different result but still
> a blank ascii data page. The message was :
> 
> ASII Contents of Sector 1205162 (512 bytes) in images/hdb1
> 
> and that was all that was displayed.
> 
> I clicked on the Hex tab and it displayed the data in that sector.
> 
> When I clicked on the Ascii tab after that the ASCII characters were
> displayed.
> 
> Could this be a browser problem? I'm using Konqueror 3.03 (using KDE 3.03)

The above sounds like a browser issue.  I use Mozilla and it also sometimes 
does not display a page.  But, it is rare.

> I have not edited the files you referred to as of yet.

That would be the most helpful.  I can send you the file with the
edits in it if you send me a copy of your autopsyfunc.pm (off line).

thanks,
brian