[sleuthkit-users] fls simply reports usage information?

[Seth A. <sa...@im...>]

Hello,

I've been trying to use autopsy's interface to the sleuthkit tools to
try to recover information from my brother's sandisk CF card. (_Very_
impressive-looking tools! Job well done on the interface.)

However, I'm stopped very early on by a failing 'fls' command. Autopsy's
file/directory listing interface is clearly not prepared to handle the
usage() output from fls. I used 'strace' to find the arguments to the
fls command, which (as I recall from memory..) looked like this:

  fls -f fat -la -s 0 /path/to/dd/image 2

I tried running fls by hand innumerable times with various permuations
of the arguments like this:

  fls -f fat -la -s 0 /path/to/dd/image 2
  fls -f fat -l -a -s 0 /path/to/dd/image 2
  fls -f fat -la -s0 /path/to/dd/image 2
  fls -f fat -l -a -s0 /path/to/dd/image 2

  fls -f fat -la -s 0 /path/to/dd/image 1
  fls -f fat -l -a -s 0 /path/to/dd/image 1
  fls -f fat -la -s0 /path/to/dd/image 1
  fls -f fat -l -a -s0 /path/to/dd/image 1

  fls -f fat -la -s 0 /path/to/dd/image
  fls -f fat -l -a -s 0 /path/to/dd/image
  fls -f fat -la -s0 /path/to/dd/image
  fls -f fat -l -a -s0 /path/to/dd/image

  fls -f fat -s 0 /path/to/dd/image 2
  fls -f fat -s0 /path/to/dd/image 2

  fls -f fat -s 0 /path/to/dd/image
  fls -f fat -s0 /path/to/dd/image

  fls -f fat /path/to/dd/image 2

  fls -f fat /path/to/dd/image

  fls -f fat -la -s 0 /path/to/dd/image 2 2

Every single attempt _always_ reported the usage statement. :(

I glanced at the fls.c source code, but didn't spot anything obviously
wrong in the main() function.

I'm using the version of sleuthkit as packaged in Debian Unstable on my
G3 iBook. Debian reports the version is 1.73-4. There are no related
bugs filed at bugs.debian.org.

Does anyone have suggestions what to do next? :)

Thanks!