Re: [sleuthkit-users] File system detection issue with fsstat

[Brian C. <ca...@sl...>]

On Jun 6, 2005, at 10:58 AM, Jaime Chang wrote:

> Hi all,
>
> I run the fsstat command against an ext3 hard drive partition and I 
> got the following error:
>
>   fsstat: Cannot determine if EXT2/3 or FAT
>
> I am wondering if any of you guys have seen this before. Is this an 
> isolated case?... What are the probabilities that fsstat can not 
> detect the supported file systems?

This occurs when you have both a valid FAT boot sector (in sector 0) 
and a valid EXT2/3 superblock (in sectors 2 & 3).  Instead of assuming 
which you want to use, the tools will force you to specify.

This was covered in the last Informer:

http://www.sleuthkit.org/informer/sleuthkit-informer-20.html#autodetect

This can also occur with NTFS and Ext2/3 or UFS.  There are some test 
images on dftt.sf.net.

brian