[sleuthkit-users] fls - error

[Geert V. A. <gee...@pa...>]

I'm having a little problem with fls, output:

# fls -o 63 -r -m /mnt/case /mnt/flurk/hd1.dd > flsoutput
fls: fatfs_file_walk: Invalid starting cluster address in Directory
Entry (too large): 181248152

It's a hdd with 1 fat32 partitions starting at cluster 63, and I would
like to have a timeline (mactime)

Information about FS:

Sectors before file system: 63

File System Layout (in sectors)
Total Range: 0 - 6330176
* Reserved: 0 - 31
** Boot Sector: 0
** FS Info Sector: 1
** Backup Boot Sector: 6
* FAT 0: 32 - 6207
* FAT 1: 6208 - 12383
* Data Area: 12384 - 6330176
** Cluster Area: 12384 - 6330175
*** Root Directory: 12384 - 130855
** Non-clustered: 6330176 - 6330176

METADATA INFORMATION

Range: 2 - 101084674
Root Directory: 2

CONTENT INFORMATION

Sector Size: 512
Cluster Size: 4096
Total Cluster Range: 2 - 789725


Anyone who has idea ?

Brian, thanks for your efforts !

Thanks,

Geert VAN ACKER