Re: [sleuthkit-users] dls

[Brian C. <ca...@sl...>]

On Mar 23, 2005, at 12:33 PM, Brian Starr wrote:

> Hi everyone,
> =A0
> =46rom the command line, I used dls to extract the unallocated space=20=

> from my image file.=A0 I then used strings to pull=A0the text out=A0from=
 the=20
> dls file.=A0 I then used grep to do a keyword search.=A0 My question =
is=20
> what does the number (address) mean from the dls file?=A0

What number are you referring to?  Is the number from strings?  Or=20
grep?  If you extract the unallocated content, dls is not giving a=20
number.  If grep or stings is, then it is the byte offset.

> How can I go from the number=A0in the dls file to the exact location =
in=20
> the image?=A0

Check out the dcalc tool.  Its purpose is to calculate the location of=20=

a block in a dls image to a block in the original image.

> Also, does anyone know when the book, File System Forensic Analysis=20
> will be available?

It was shipped from the warehouse late last week, so it should be in=20
stores this week and it seems that those who ordered it from the=20
publisher already have it...

brian
 =20=