Re: [sleuthkit-users] dcalc - Block too large

[Brian C. <ca...@sl...>]

On Dec 9, 2004, at 4:29 PM, Dan Jones wrote:

> I recently received a "Block too large" error from dcalc while trying 
> to execute
>     dcalc -s 21187952 -f ntfs image.dd
>
> image.dd is  approximately 20 GB.
> The 'dls -s' output  from which the target fragment was determined 
> resulted in a 15 GB slack space image..

Are you sure you used the '-s' with 'dls' to get only the slack space?  
15 GB seems huge for slack space.

That message appears when it did not find the equivalent block in the 
original image.   What is the cluster size in the original image?  Do 
you also get an error if you run it with '-u NUM', which you would use 
for the unallocated address?

brian