Re: [sleuthkit-users] What are indirect blocks?

[Brian C. <ca...@sl...>]

On May 16, 2005, at 1:58 AM, Aaron Stone wrote:

> What are indirect blocks, and what does this output from 'istat' mean?

Ext2 stores the file content in blocks.  The first 12 block addresses 
that a file has allocated are stored in the inode.  The remaining 
blocks are stored in indirect blocks, which are blocks that contain a 
list of block addresses.  The error you are getting is because one of 
the addresses in an indirect block is larger than the partition is.  
This occurs when the block has been reallocated to a new file and has 
normal file content in it (and not block addresses).  In other words, 
part of your deleted file has been reallocated to new files and 
overwritten.

brian



>
> bash$ istat AaronOldImage.ext3 193
> inode: 193
> Allocated
> Group: 0
> Generation Id: 4016250406
> uid / gid: 0 / 0
> mode: -rw-r--r--
> Flags: Immutable,
> size: 6045548544
> num of links: 1
>
> Inode Times:
> Accessed:       Sun Jan 30 17:24:05 2005
> File Modified:  Wed May 12 14:40:18 2004
> Inode Modified: Wed May 12 14:42:13 2004
>
> Direct Blocks:
> 9373 9600 9602 9603 9604 9605 9606 9799
> [snip about 60 lines of block listings]
> 512422 512423 512424 534529 534530 534531 534532 534533
> istat: Invalid address in indirect list (too large): 136081568
> 534534 534535 534536 534537
> bash$
>
> Thanks,
> Aaron
>
>
> -------------------------------------------------------
> This SF.Net email is sponsored by Oracle Space Sweepstakes
> Want to be the first software developer in space?
> Enter now for the Oracle Space Sweepstakes!
> http://ads.osdn.com/?ad_id=7393&alloc_id=16281&op=click
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org