[sleuthkit-users] dls

[Brian S. <Br...@Pe...>]

Hi everyone,
 
From the command line, I used dls to extract the unallocated space from my
image file.  I then used strings to pull the text out from the dls file.  I
then used grep to do a keyword search.  My question is what does the number
(address) mean from the dls file?  How can I go from the number in the dls
file to the exact location in the image?  Or, how would I get to the sector
that the data from the search resides in?  The image is fat32.  If someone
can offer explanation how to do this using the command line and autopsy,
that would really help out.  I reviewed the sleuth-kit informers, but was
unable to find how the specifics of how this could be done.  I obviously
need to study up on fat 32 file system.  Any help is mucho appreciated.
 
Also, does anyone know when the book, File System Forensic Analysis will be
available?
 
Thanks,
Brian