Re: [sleuthkit-users] invalid arguement : fsstat, img_stat

[J B <je...@ad...>]

>> mmls /evidence/old.dd
>> *reports first sector (0) Primary Table, 1 > 62 unallocated, 63 >
>> 1031121 DOS FAT16
> <snip>
>> fsstat old.dd
>> invalid arguemnt: old.dd
>
> In addition to the fstype, as farmerdude pointed out, you will probably
> want to point to the offset to the file system.  Your mmls output
> reports that the fs is at sector 63, not the front of the image.
>
> fsstat -f fat -o 63 old.dd  (assuming it's formatted FAT).
>
>

Thank you.. at your suggestion, I tried that.  I tried offsets 61, 62, 63, 
64 and didn't get anywhere.

I changed the filename to just "old".

#mmls old  //still reports a primary table, unallocated, dos fat16 (starting 
at 63)

interestingly enough,

#fls -r -o 63 -f fat /evidence/old   //works fine, I can even grep JPG as 
long as I remember unix is case sensitive ;)

There's probably something obvious I'm overlooking with fsstat

thanks, JB