Re: [sleuthkit-users] invalid arguement : fsstat, img_stat

[Barry J. G. <bg...@im...>]

On Tue, 2006-01-10 at 22:30 -0500, J B wrote:

> mmls /evidence/old.dd 
> *reports first sector (0) Primary Table, 1 > 62 unallocated, 63 >
> 1031121 DOS FAT16
<snip>
> fsstat old.dd
> invalid arguemnt: old.dd

In addition to the fstype, as farmerdude pointed out, you will probably
want to point to the offset to the file system.  Your mmls output
reports that the fs is at sector 63, not the front of the image.

fsstat -f fat -o 63 old.dd  (assuming it's formatted FAT).


-- 
/***************************************
Special Agent Barry J. Grundy
NASA Office of Inspector General
Computer Crimes Division 
Goddard Space Flight Center
Code 190
Greenbelt Rd.
Greenbelt, MD 20771
(301)286-3358
**************************************/