[sleuthkit-users] File too large, Fat32

[<fu...@gm...>]

Hi list members

I got a problem with an image of a Fat32-Image.

The situation:
An image of an external usb harddrive, formated with FAT (mounted as a
loopback, mount shows vfat). On the disk are some backup-files from MyBackup
PC from Stomp. 

The problem:
3 of the 4 Backup files are broken, but one is still complete (hope so). Is
has a size of 4 gigabyte when I take a look at it via Windows or via mounted
loopback device. But if load the image to autopsy (2.0.0), the file looks
like this:

Name:
120404.qic	  	

Written:
2004.04.12 16:42:18 (CEST)

Modified:
2004.05.27 00:00:00 (CEST)

Created:
2004.04.12 16:42:18 (CEST)

Size:
18446744073709546496

Meta:
164

Obviously, the file size is wrong here. I don't know any USB drive with such
size. when I take a look at the file content I see nothing also got File
Type: empty. Exporting also does not work. I'm now wondering what happens
here?

I mounted the image as FAT32. With the other FAT's I had no access. 

There are also two other huge files which are NOT allocated. There happens
the same. Of course I'm interested in their content. The size of these files
are 
ackup.bkf (_ACKUP.BKF): 18446744073709523968
_Za03576 (_ZA03576): 18446744073709155022
Also both impossible size.

I read assuming the real size of a file under FAT is very hard, is this the
case here? Any hope to get the deleted files (other tools e.g.)?

thank you 

Fuerst


-- 
"Sie haben neue Mails!" - Die GMX Toolbar informiert Sie beim Surfen!
Jetzt aktivieren unter http://www.gmx.net/info