[sleuthkit-users] What are indirect blocks?

[Aaron S. <aa...@se...>]

Hey folks,

I've been Googling for days to try to recover what appears to be a pretty
bad image of my old 60GB /home partition. I've given up on e2retieve and
e2salvage, and am now working with TSK and e2extract:

http://dreamscape.org/toolkit/README.html

The scoop is that buried in this image is another image of my old laptop's
hard drive. I desperately need to grab a 6GB needle out of a 60GB
haystack.

What are indirect blocks, and what does this output from 'istat' mean?

bash$ istat AaronOldImage.ext3 193
inode: 193
Allocated
Group: 0
Generation Id: 4016250406
uid / gid: 0 / 0
mode: -rw-r--r--
Flags: Immutable,
size: 6045548544
num of links: 1

Inode Times:
Accessed:       Sun Jan 30 17:24:05 2005
File Modified:  Wed May 12 14:40:18 2004
Inode Modified: Wed May 12 14:42:13 2004

Direct Blocks:
9373 9600 9602 9603 9604 9605 9606 9799
[snip about 60 lines of block listings]
512422 512423 512424 534529 534530 534531 534532 534533
istat: Invalid address in indirect list (too large): 136081568
534534 534535 534536 534537 
bash$

Thanks,
Aaron