Re: [sleuthkit-users] fls core

[Josep M H. <jm...@me...>]

Brian Carrier wrote:
> On Tue, Mar 25, 2003 at 05:15:38PM +0100, Josep M Homs wrote:
> 
>>>Also, can you run:
>>>
>>>	# fls -f solaris -la -z CET -s 1 path/c0t0d0s0-root.dd
>>>
>>>Does it core?
>>
>>Yes , it does.
> 
> 
> Strange.  Can you try it with out the '-l' and without the '-a' to  
> figure out which flags are causing the core (since it does not always
> crash).  Can you also run the a version that crashes with the '-v' flag
> to get some more details about where it is crashing?  

The problematic flag seems to be "-l" , with only "-a" dont crash.
I paste the last lines with "-v" :

fs_read_block: read block 56 offs 57344 len 8192 (inode block)
fs_read_block: read block 24 offs 24576 len 8192 (cylinder block)
-/r 214:        .bash_history   2003.03.16 22:19:19 (CET) 
2003.03.16 22:19:19 (CET)       2003.03.16 22:19:19 (CET)       3 
1       0
Segmentation fault (core dumped)
blackbox:/usr/local/bin/task/bin#

> 
> What platform are you running this on?  


FreeBSD 4.8-RC #0: Mon Mar 24 19:52:47 CET 2003


> 
> Or, you can attach it to gdb and get some runtime details:
> 
> 1.  run 'gdb ./fls' from the bin directory
> 2.  type 'set args -f solaris -la -z CET -s 1 path/c0t0d0s0-root.dd'
> 3.  type 'run'
> 4.  When it cores, type 'bt' to get the stack trace and send that output.
> 


OK , so portinstall gdb ;-)
I have to leave now ... i'll send you the output in some hours.


> Thanks!
> 

thanks to you ,
Josep M Homs

> brian
>