[sleuthkit-users] What are indirect blocks?
Brought to you by:
carrier
|
From: Aaron S. <aa...@se...> - 2005-05-16 06:59:05
|
Hey folks, I've been Googling for days to try to recover what appears to be a pretty bad image of my old 60GB /home partition. I've given up on e2retieve and e2salvage, and am now working with TSK and e2extract: http://dreamscape.org/toolkit/README.html The scoop is that buried in this image is another image of my old laptop's hard drive. I desperately need to grab a 6GB needle out of a 60GB haystack. What are indirect blocks, and what does this output from 'istat' mean? bash$ istat AaronOldImage.ext3 193 inode: 193 Allocated Group: 0 Generation Id: 4016250406 uid / gid: 0 / 0 mode: -rw-r--r-- Flags: Immutable, size: 6045548544 num of links: 1 Inode Times: Accessed: Sun Jan 30 17:24:05 2005 File Modified: Wed May 12 14:40:18 2004 Inode Modified: Wed May 12 14:42:13 2004 Direct Blocks: 9373 9600 9602 9603 9604 9605 9606 9799 [snip about 60 lines of block listings] 512422 512423 512424 534529 534530 534531 534532 534533 istat: Invalid address in indirect list (too large): 136081568 534534 534535 534536 534537 bash$ Thanks, Aaron |