Re: [sleuthkit-users] Question regarding keyword search
Brought to you by:
carrier
From: Brian C. <bca...@at...> - 2003-03-12 01:06:00
|
> >> Is it just the unallocated space or all of the > >>partition? > > As far as I can tell, I'm searching the entire partition. The page is > titled "Keyword search on images/hdb1 - which is the name of the > image. This is true. You can also just search the unallocated space by using the 'Extract Unallocated Space' button on the bottom. > I left the defaults with regard to Strings file etc. However, when I > unchecked > the MD5 options, in an effort to speed searching, The initial MD5 check value will have no impact on the speed of the process. The MD5 only takes longer when the image is initially imported. > I got the same error in > the > LHS frame : "Error identifying block size (dcat -s output)", and of course > no results. The error is on the left-hand side now? That is very strange, since it means that sometimes it works and sometimes it doesn't. The errors last night were on the right-hand side correct? > No, I repeated the search for Linda, and got a different result but still > a blank ascii data page. The message was : > > ASII Contents of Sector 1205162 (512 bytes) in images/hdb1 > > and that was all that was displayed. > > I clicked on the Hex tab and it displayed the data in that sector. > > When I clicked on the Ascii tab after that the ASCII characters were > displayed. > > Could this be a browser problem? I'm using Konqueror 3.03 (using KDE 3.03) The above sounds like a browser issue. I use Mozilla and it also sometimes does not display a page. But, it is rare. > I have not edited the files you referred to as of yet. That would be the most helpful. I can send you the file with the edits in it if you send me a copy of your autopsyfunc.pm (off line). thanks, brian |