Re: [sleuthkit-users] Linux and "unrecognized" sectors

[Eagle I. S. Inc. <in...@ea...>]

Paul,

This is a well discussed, and well solved issue. Look in the archives, or
on linuxforensics yahoo group.

The simplest answer is to use the 2.6 kernel or use a patch for the 2.4
kernel to get around this.

Google is your friend.

And, Sleuthkit won't be affected per se, since it will analyze whatever
you hand to it and quite successfully too.

Niall.





Paul Stillwell wrote:
> Hello all,
>
>     I'm reading some articles and one that I have come across (was
> handed to me unfortunately no link) and it says that Linux will not
> recognize the last sector of a disk if it has an odd number of sectors.
> I had never heard this before and it has prompted a couple of questions.
>
> 1)  will this affect an image acquired using dd?
>
> 2)  will it affect Sleuthkit's handling of an image of this drive?
>
> Thanks!
>
> Paul
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by: Splunk Inc. Do you grep through log
> files
> for problems?  Stop!  Download the new AJAX search engine that makes
> searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=103432&bid=230486&dat=121642
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>