Re: [sleuthkit-users] dls

[Jacob K. <jac...@gm...>]

File System Forensic Analysis book:

I pre-ordered the book from www.awprofessional.com and received it in
the mail yesterday. If you become a "member" of the site (which
consists of signing up for a free account) they sell the book for
$34.99. AW sends promotional codes for 35% off your next purchase in
the notification emails too. Not to toot AW's horn, but it sure beats
paying $49.99 at amazon or bn.com. (Hopefully, this doesn't take away
from anything that you make Brian. Sorry.)

Jacob


On Wed, 23 Mar 2005 09:33:13 -0800, Brian Starr <Br...@pe...> wrote:
>  
> Hi everyone, 
>   
> From the command line, I used dls to extract the unallocated space from my
> image file.  I then used strings to pull the text out from the dls file.  I
> then used grep to do a keyword search.  My question is what does the number
> (address) mean from the dls file?  How can I go from the number in the dls
> file to the exact location in the image?  Or, how would I get to the sector
> that the data from the search resides in?  The image is fat32.  If someone
> can offer explanation how to do this using the command line and autopsy,
> that would really help out.  I reviewed the sleuth-kit informers, but was
> unable to find how the specifics of how this could be done.  I obviously
> need to study up on fat 32 file system.  Any help is mucho appreciated. 
>   
> Also, does anyone know when the book, File System Forensic Analysis will be
> available? 
>   
> Thanks, 
> Brian 
>  
> 
>   
>