Re: [sleuthkit-users] fls simply reports usage information?

[Brian C. <ca...@sl...>]

On Jan 5, 2005, at 6:04 PM, Seth Arnold wrote:

> Hello,
>
> I've been trying to use autopsy's interface to the sleuthkit tools to
> try to recover information from my brother's sandisk CF card. (_Very_
> impressive-looking tools! Job well done on the interface.)
>
> However, I'm stopped very early on by a failing 'fls' command. 
> Autopsy's
> file/directory listing interface is clearly not prepared to handle the
> usage() output from fls. I used 'strace' to find the arguments to the
> fls command, which (as I recall from memory..) looked like this:
>
>   fls -f fat -la -s 0 /path/to/dd/image 2

[For future reference, the commands are listed in the execution log in 
the evidence locker. :) ]

Are you sure you have a partition image and not a disk image?  What is 
the error message before the usage information is displayed. There 
should be one line that explains why it gave an error.

> I'm using the version of sleuthkit as packaged in Debian Unstable on my
> G3 iBook. Debian reports the version is 1.73-4. There are no related
> bugs filed at bugs.debian.org.

Hmm.  I do not know of anyone that has used them under Debian on an 
iBook.  There could be an endian ordering issue with the package.  You 
may want to try directly from the source.

brian