[sleuthkit-users] fls ext2fs_dinode_lookup error

[Ed <wh...@dm...>]

Hi

I'm trying to recover some deleted files from an ext3 volume group spanned
across 2 physical disks on a CentOS 4 system.  I've done a dd of the
volgroup (/dev/mapper/VolGroup00-LogVol00), but when I try to fls this image
(fls -f linux-ext3 -d image.dd) I get the following error:

/usr/local/sleuthkit/bin/fls: ext2fs_dinode_lookup: Error reading inode
386305 from 322233664

This error is also output to the autopsy console when doing file analysis
(which doesn't correctly list the contents of the partition)

Also fsstat gives a similar error from the 'image details' page in autopsy.

My suspicion is that this is something to do with the volume group, but I
can't find any suggestions on Google or the mailing list.

Can anyone provide any pointers on how to get this to work?

Many thanks

Ed