Re: [sleuthkit-users] read error

[Brian C. <ca...@ce...>]

How big exactly is the image?  that message usually appears when it
tries to read past the end of the file (if a few blocks were missed) or
if it is trying to read invalid data.  Invalid data usually exists
because the file was deleted and the block pointers were written over
with different data.

Run 'fls' from the command line (with -rp) to see where the error
occurs.  Then do an istat on the file.

fls -f ntfs -rp IMG

brian

On Thu, Apr 10, 2003 at 04:18:13PM +0200, Josep M Homs wrote:
> All my past problems with fls were solved ,
> but i still have problems with the biggest partition (12Gb).
> While creating the timeline body file the following read error appears :
> 
> /usr/local/bin/sleuthkit/bin/fls: read block read error 
> (8192@12624838656): Unknown error: 0 Running ils -m on 
> images/c0t0d0s6-usr.dd
> 
> I copied this partition thru dd/ssh with the source system up and 
> running , could that be the problem ?
> must i boot from a live cd system in order to produce a good image ?
> note that I have no problem with the other partitions that were copied 
> that way ...
> 
> Thanks ,
> Josep M Homs
> 
> 
> 
> -------------------------------------------------------
> This SF.net email is sponsored by: Etnus, makers of TotalView, The debugger 
> for complex code. Debugging C/C++ programs can leave you feeling lost and 
> disoriented. TotalView can help you find your way. Available on major UNIX 
> and Linux platforms. Try it free. www.etnus.com
> _______________________________________________
> sleuthkit-users mailing list
> sle...@li...
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users