Re: [sleuthkit-users] FileSystem Too Large

[Brian C. <ca...@sl...>]

On Jan 26, 2005, at 12:01 PM, Dott. D.E. Caccavella wrote:

> Hi to everybody,
>
> I have acquired with dd a filesystem FAT32 of 160 GBs, but  analyzing 
> it
> with Autopsy, and with the  sleuthkit tools, I have the message error 
> : "..
> File Sytem too large.. "
>
>
> what can I do?

You can wait until version 2 is released (in a few weeks hopefully).... 
   This is a side effect of the metadata addresses that TSK assigns to 
FAT directory entries (since FAT does not normally assign addresses to 
them). They are limited to the INUM_T size on your computer, which is 
typically 32-bits.  You can try to comment out the size check and see 
if you run into problems, but be careful.  The check is on line 1877 
and 1878 of src/fstools/fatfs.c.  Just start each line with '//' and 
recompile.  It will work on systems that assign the inum_t size to be 
64-bits.

brian