[sleuthkit-users] USB flash disk and TSK

[youcef b. <ybi...@ya...>]

Hi,

I have a 128 MB USB flash disk which I imaged using
the dd tool.

the mmls command on the image is giving me this
output:

     Slot    Start        End          Length      
Description
00:  -----   0000000000   0000000000   0000000001  
Primary Table (#0)
01:  -----   0000000001   0000000031   0000000031  
Unallocated
02:  00:00   0000000032   0000252927   0000252896  
DOS FAT16 (0x06)

the fssat is giving me this output:

File System Type: FAT16 

OEM Name: MSDOS5.0 
Volume ID: 0x1c52e261 
Volume Label (Boot Sector): NO NAME 
Volume Label (Root Directory): FORENSIC 
File System Type Label: FAT16 

Sectors before file system: 32 

File System Layout (in sectors) 
Total Range: 0 - 252895 
* Reserved: 0 - 0 
** Boot Sector: 0 
* FAT 0: 1 - 247 
* FAT 1: 248 - 494 
* Data Area: 495 - 252895 
** Root Directory: 495 - 526 
** Cluster Area: 527 - 252894 
** Non-clustered: 252895 - 252895 




--------------------------------------------------------------------------------
METADATA INFORMATION 
Range: 2 - 4037890 
Root Directory: 2 




--------------------------------------------------------------------------------
CONTENT INFORMATION 
Sector Size: 512 
Cluster Size: 2048 
Total Cluster Range: 2 - 63093 


- what puzzles me about the mmls output is that adding
all the sectors (1+31+252896) will give me a size
around 126M and not 128M.

- The other puzzling thing is the fsstat output. the
FAT table is 247 sectors and therefore capable of
holding 31616 entries (128 * 247), whereas the cluster
range is 2-63093. This means that we have a lot of
clusters which cannot be referenced via the FAT table.


can anyone shed a light on this please






		
___________________________________________________________ 
How much free photo storage do you get? Store your holiday 
snaps for FREE with Yahoo! Photos http://uk.photos.yahoo.com