Re: [sleuthkit-users] USB flash disk and TSK

[Brian C. <ca...@sl...>]

> - what puzzles me about the mmls output is that adding
> all the sectors (1+31+252896) will give me a size
> around 126M and not 128M.

It depends on if you divide by 1000 or 1024 to get KB and MB and the  
partition may not occupy the full disk.  I don't think all storage  
devices are exactly the size they say they are.  how many sectors do  
you get if you image the device?


> - The other puzzling thing is the fsstat output. the
> FAT table is 247 sectors and therefore capable of
> holding 31616 entries (128 * 247), whereas the cluster
> range is 2-63093. This means that we have a lot of
> clusters which cannot be referenced via the FAT table.

Eamonn is correct, each FAT entry in FAT16 is 2 bytes, not 4 bytes so  
there are 256 entries per sector.

brian