[sleuthkit-users] Help on indirect blocks!
Brought to you by:
carrier
From: Monserrat R. <mrg...@ya...> - 2005-09-26 16:14:51
|
Hello everyone! I'm a new user of the Sleuth Kit and I don't know if I'm doing something wrong... I lost a entire FS (the super block was damaged... the backup copies either) but I only want to recover one file; by now I know that the inode that this file use is the 182584, but when I ran the icat command with the verbose option, the output is as follow: inodes 12393472 root ino 2 cyl groups 2128 blocks 104587230 fs_read_block: read block 1525976 offs 1562599424 len 8192 (inode block) fs_read_block: read block 1525720 offs 1562337280 len 8192 (cylinder block) fs_read_block: read block 1566736 offs 1604337664 len 8192 (data block) fs_read_block: read block 1566744 offs 1604345856 len 8192 (data block) fs_read_block: read block 1566752 offs 1604354048 len 8192 (data block) fs_read_block: read block 1566760 offs 1604362240 len 8192 (data block) fs_read_block: read block 1566768 offs 1604370432 len 8192 (data block) fs_read_block: read block 1566776 offs 1604378624 len 8192 (data block) fs_read_block: read block 1566784 offs 1604386816 len 8192 (data block) fs_read_block: read block 1566792 offs 1604395008 len 8192 (data block) fs_read_block: read block 1566800 offs 1604403200 len 8192 (data block) fs_read_block: read block 1566808 offs 1604411392 len 8192 (data block) fs_read_block: read block 1566816 offs 1604419584 len 8192 (data block) fs_read_block: read block 1566824 offs 1604427776 len 8192 (data block) ffs_file_walk_indir: level 1 block 60018960 fs_read_block: read block 60018960 offs 61459415040 len 8192 (disk address block) fs_read_block: read block 26886951 offs 27532237824 len 8192 (data block) Invalid address in indirect list (too large): 965017603 My guess is that I have troubles with the reference with the reference to the indirect blocks... in fact, in the output file the output from the direct blocks are consistent with the info I'm expecting but the indirect blocks aren't. Any help? I running the Sleuth kit in a Solaris 8 environment... believe me, any help will be appreciate. Thanks in advance, Monserrat. |