Re: [sleuthkit-users] read error

[Brian C. <ca...@sl...>]

Interesting.  FFS actually allows you to have a file system size that is not a
multiple of the block size, but it is a multiple of the fragment size.  In
this case, it appears that you have data in the last 4 fragments and it is
trying to read the full block and just extract the fragments.  Can you run the
'fls -rp' with '-v' as well to get the verbose output?  I need to find out
where it is being called from.

I just fixed a bug in 'fsstat' that takes this into account (notice that the
last fragments in the group extend beyond the final fragment).

brian