Re: [sleuthkit-users] dls

[Matthew M S. <mm...@ta...>]

Thanks for the info Jacob..

Now a review of the book would be really great....


M. Shannon

On Wed, 2005-03-23 at 15:19, Jacob Kitchel wrote:
> File System Forensic Analysis book:
> 
> I pre-ordered the book from www.awprofessional.com and received it in
> the mail yesterday. If you become a "member" of the site (which
> consists of signing up for a free account) they sell the book for
> $34.99. AW sends promotional codes for 35% off your next purchase in
> the notification emails too. Not to toot AW's horn, but it sure beats
> paying $49.99 at amazon or bn.com. (Hopefully, this doesn't take away
> from anything that you make Brian. Sorry.)
> 
> Jacob
> 
> 
> On Wed, 23 Mar 2005 09:33:13 -0800, Brian Starr <Br...@pe...> wrote:
> >  
> > Hi everyone, 
> >   
> > From the command line, I used dls to extract the unallocated space from my
> > image file.  I then used strings to pull the text out from the dls file.  I
> > then used grep to do a keyword search.  My question is what does the number
> > (address) mean from the dls file?  How can I go from the number in the dls
> > file to the exact location in the image?  Or, how would I get to the sector
> > that the data from the search resides in?  The image is fat32.  If someone
> > can offer explanation how to do this using the command line and autopsy,
> > that would really help out.  I reviewed the sleuth-kit informers, but was
> > unable to find how the specifics of how this could be done.  I obviously
> > need to study up on fat 32 file system.  Any help is mucho appreciated. 
> >   
> > Also, does anyone know when the book, File System Forensic Analysis will be
> > available? 
> >   
> > Thanks, 
> > Brian 
> >  
> > 
> >   
> >
> 
> 
> -------------------------------------------------------
> This SF.net email is sponsored by Microsoft Mobile & Embedded DevCon 2005
> Attend MEDC 2005 May 9-12 in Vegas. Learn more about the latest Windows
> Embedded(r) & Windows Mobile(tm) platforms, applications & content.  Register
> by 3/29 & save $300 http://ads.osdn.com/?ad_id=6883&alloc_id=15149&op=click
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
-- 
Matthew M. Shannon, CIFI, CISSP
Principal 
Agile Risk Management LLC
www.agilerm.net
msh...@ag...
(c)813.732.5076
(o)1.877.AGILE13 (244.5313)