Re: [sleuthkit-users] read error

[Josep M H. <jm...@me...>]

Brian Carrier wrote:
> Interesting.  FFS actually allows you to have a file system size that is not a
> multiple of the block size, but it is a multiple of the fragment size.  In
> this case, it appears that you have data in the last 4 fragments and it is
> trying to read the full block and just extract the fragments.  Can you run the
> 'fls -rp' with '-v' as well to get the verbose output?  I need to find out
> where it is being called from.
> 
/usr/local/bin/sleuthkit/bin/fls -f solaris -rp -v ./c0t0d0s6-usr.dd
inodes 1477504 root ino 2 cyl groups 238 blocks 12328948
fs_read_block: read block 32 offs 32768 len 8192 (inode block)
fs_read_block: read block 24 offs 24576 len 8192 (cylinder block)
fs_read_block: read block 824 offs 843776 len 8192 (data block)
-/d 3:  lost+found
fs_read_block: read block 816 offs 835584 len 8192 (data block)
fs_read_block: read block 5859232 offs 5999853568 len 8192 (inode block)
fs_read_block: read block 5859216 offs 5999837184 len 8192 (cylinder block)


-------- [cut] ----------------------


-/d 1465088:    lib/devfsadm
fs_read_block: read block 12232360 offs 12525936640 len 8192 (data block)
fs_read_block: read block 103952 offs 106446848 len 8192 (inode block)
fs_read_block: read block 103944 offs 106438656 len 8192 (cylinder block)
fs_read_block: read block 12233920 offs 12527534080 len 8192 (inode block)
fs_read_block: read block 12232361 offs 12525937664 len 1024 (link block)
fs_read_block: read block 12233912 offs 12527525888 len 8192 (cylinder 
block)
-/l 1465089:    lib/devfsadm/devfsadmd
fs_read_block: read block 12285880 offs 12580741120 len 8192 (inode block)
fs_read_block: read block 12285872 offs 12580732928 len 8192 (cylinder 
block)
-/d 1471296:    lib/devfsadm/linkmod
fs_read_block: read block 12328944 offs 12624838656 len 8192 (data block)
/usr/local/bin/sleuthkit/bin/fls: read block read error 
(8192@12624838656): Unknown error: 0


> I just fixed a bug in 'fsstat' that takes this into account (notice that the
> last fragments in the group extend beyond the final fragment).
> 
> brian
>