Re: [sleuthkit-users] What are indirect blocks?

[Aaron S. <aa...@se...>]

On Mon, May 16, 2005, Brian Carrier <ca...@sl...> said:

> On May 16, 2005, at 1:58 AM, Aaron Stone wrote:
> 
>> What are indirect blocks, and what does this output from 'istat' mean?
> 
> Ext2 stores the file content in blocks.  The first 12 block addresses 
> that a file has allocated are stored in the inode.  The remaining 
> blocks are stored in indirect blocks, which are blocks that contain a 
> list of block addresses.  The error you are getting is because one of 
> the addresses in an indirect block is larger than the partition is.  
> This occurs when the block has been reallocated to a new file and has 
> normal file content in it (and not block addresses).  In other words, 
> part of your deleted file has been reallocated to new files and 
> overwritten.

The file was never deleted; the disk was dying and I made an image before
sending it in for RMA. The other partition image off this disk mounts
completely cleanly and all files are accessible, but this partition didn't
make it so well.

Aaron