Re: [sleuthkit-users] Getting cluster from off-set

[Brian C. <ca...@ce...>]

On Sep 16, 2004, at 3:18 PM, Horner, Jonathan J (JH8) wrote:

> I know this is probably painfully easy, but I'm crunched for time and
> without ability to form a coherent thought.
>
> Can someone remind me how to get a cluster number when I've got the 
> offset
> of string returned by 'strings --radix=d'?

Divide the byte offset by the cluster size.  You can get the cluster 
size from running 'fsstat' on the image, or using the Image Details 
view in autopsy.  The remainder from dividing is the byte offset into 
the cluster.

brian