Re: [sleuthkit-users] using sorter to recover files from unallocated inodes, not just r emoved ones

[Brian C. <ca...@sl...>]

To finish this thread from last week, there is a bug in 'sorter'.  The
regular expression that parses the output of 'ils' was missing a ' '
and therefore some of the entries were not being processed.  

Line 531 should be:

       unless ((defined $inode) && ($inode =~ /^[0-9\-] $/) &&

and not:

        unless ((defined $inode) && ($inode =~ /^[0-9\-]$/) &&

I'm finishing up some new tools for listing disk partitions and would like
to wait a few days until they are done before I release a new version. 
Let me know if you want me to send you a fixed copy of the file before
then.

brian