Re: [sleuthkit-users] read error

[Josep M H. <jm...@me...>]

Brian Carrier wrote:
> How big exactly is the image?  

-rw-r--r--  1 root  wheel  12624842752 Apr  9 20:34 c0t0d0s6-usr.dd

that message usually appears when it
> tries to read past the end of the file (if a few blocks were missed) or
> if it is trying to read invalid data.  Invalid data usually exists
> because the file was deleted and the block pointers were written over
> with different data.
> 
> Run 'fls' from the command line (with -rp) to see where the error
> occurs.  Then do an istat on the file.
> 
> fls -f ntfs -rp IMG
> 

#/usr/local/bin/sleuthkit/bin/fls -f solaris -rp ./c0t0d0s6-usr.dd
---[cut]-----
-/d 1465088:    lib/devfsadm
-/l 1465089:    lib/devfsadm/devfsadmd
-/d 1471296:    lib/devfsadm/linkmod
/usr/local/bin/sleuthkit/bin/fls: read block read error 
(8192@12624838656): Unknown error: 0
#/usr/local/bin/sleuthkit/bin/istat -f solaris ./c0t0d0s6-usr.dd 1471296
inode: 1471296
Allocated
Group: 237
uid / gid: 0 / 3
mode: drwxr-xr-x
size: 512
num of links: 2

Inode Times:
Accessed:       Mon Mar 17 16:16:24 2003
File Modified:  Thu Oct 17 12:21:23 2002
Inode Modified: Thu Oct 17 12:21:23 2002

Direct Blocks:
12328944


> brian
> 
> On Thu, Apr 10, 2003 at 04:18:13PM +0200, Josep M Homs wrote:
> 
>>All my past problems with fls were solved ,
>>but i still have problems with the biggest partition (12Gb).
>>While creating the timeline body file the following read error appears :
>>
>>/usr/local/bin/sleuthkit/bin/fls: read block read error 
>>(8192@12624838656): Unknown error: 0 Running ils -m on 
>>images/c0t0d0s6-usr.dd
>>
>>I copied this partition thru dd/ssh with the source system up and 
>>running , could that be the problem ?
>>must i boot from a live cd system in order to produce a good image ?
>>note that I have no problem with the other partitions that were copied 
>>that way ...
>>
>>Thanks ,
>>Josep M Homs
>>
>>
>>
>>-------------------------------------------------------
>>This SF.net email is sponsored by: Etnus, makers of TotalView, The debugger 
>>for complex code. Debugging C/C++ programs can leave you feeling lost and 
>>disoriented. TotalView can help you find your way. Available on major UNIX 
>>and Linux platforms. Try it free. www.etnus.com
>>_______________________________________________
>>sleuthkit-users mailing list
>>sle...@li...
>>https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> 
> 
>