Re: [sleuthkit-users] USB flash disk and TSK

[youcef b. <ybi...@ya...>]

Hi Brian,

>how many sectors do you get if you image the device?
this is the ouptut of the dd command:

252840+0 records in
252840+0 records out
129454080 bytes (129 MB) copied, 144.047 seconds, 899
kB/s

Brian I was following your wondefull book for the FAT
analysis and I stumbled on page 225 when you gave a
formula on how to determine if there are unused
sectors.

the fomular says: 
(total sectors - address of cluster 2) / (number of
clusters per cluster)

my understanding is that the formual should be:

(total sectors - address of cluster 2)+1 / (number of
clusters per cluster)

Am I correct or is it just one of my late night
reading syndrome.

regards

youcef

--- Brian Carrier <ca...@sl...> wrote:

> > - what puzzles me about the mmls output is that
> adding
> > all the sectors (1+31+252896) will give me a size
> > around 126M and not 128M.
> 
> It depends on if you divide by 1000 or 1024 to get
> KB and MB and the  
> partition may not occupy the full disk.  I don't
> think all storage  
> devices are exactly the size they say they are.  how
> many sectors do  
> you get if you image the device?
> 
> 
> > - The other puzzling thing is the fsstat output.
> the
> > FAT table is 247 sectors and therefore capable of
> > holding 31616 entries (128 * 247), whereas the
> cluster
> > range is 2-63093. This means that we have a lot of
> > clusters which cannot be referenced via the FAT
> table.
> 
> Eamonn is correct, each FAT entry in FAT16 is 2
> bytes, not 4 bytes so  
> there are 256 entries per sector.
> 
> brian
> 
> 



	
	
		
___________________________________________________________ 
Yahoo! Messenger - NEW crystal clear PC to PC calling worldwide with voicemail http://uk.messenger.yahoo.com