Re: [sleuthkit-users] read error

[Brian C. <ca...@sl...>]

Josep M Homs <jm...@me...> said:

> Brian Carrier wrote:
> > How big exactly is the image?  
> 
> -rw-r--r--  1 root  wheel  12624842752 Apr  9 20:34 c0t0d0s6-usr.dd
>

..
 
>
> -/d 1471296:    lib/devfsadm/linkmod
> /usr/local/bin/sleuthkit/bin/fls: read block read error 
> (8192@12624838656): Unknown error: 0

It is trying to read 8192 bytes at 12624838656, but there is only 4096 bytes
left in the image.  So, there are either invalid pointers or you are missing
part of the image.  What is the 'fsstat' output for the image.  That will give
the total number of blocks in the file system.  As the image size is not a
multiple of 8192 (the block size), I would guess that you do not have the full
image.  The 'fsstat' output contains the required info.


brian