Re: [sleuthkit-users] Linux and "unrecognized" sectors

[farmer d. <far...@ya...>]

Hi Paul,

Linux doesn't access the last odd sector when
initializing file systems and so the article you read
probably indicated using Linux to acquire may leave
the last sector if the count is odd or similar.  

This is true for the 2.4 Linux kernel because the
block layer uses 1024 and a sector is 512, so it
cannot be accessed when going through the block layer
(such as 'dd' does when dumping a device).  The block
layer was rewritten in the 2.6 kernel so a 2.6 can
access this last odd sector for those Windows file
system types that use it.  

A side note, you can happily acquire that sector using
the 2.4 Linux kernel, too.  Just avoid the block layer
and use the raw device.  I do this when I need to and
teach about it in my training classes.  You don't need
a 2.6 kernel to get the last odd sector.  You only
need to know what the problem is and how to work
around it in the 2.4 series kernels.


regards,

farmerdude

http://www.farmerdude.com/



--- Paul Stillwell <pa...@vn...> wrote:

> Hello all,
> 
>     I'm reading some articles and one that I have
> come across (was 
> handed to me unfortunately no link) and it says that
> Linux will not 
> recognize the last sector of a disk if it has an odd
> number of sectors.  
> I had never heard this before and it has prompted a
> couple of questions.
> 
> 1)  will this affect an image acquired using dd?
> 
> 2)  will it affect Sleuthkit's handling of an image
> of this drive?
> 
> Thanks!
> 
> Paul
> 
> 
>
-------------------------------------------------------
> This SF.net email is sponsored by: Splunk Inc. Do
> you grep through log files
> for problems?  Stop!  Download the new AJAX search
> engine that makes
> searching your log files as easy as surfing the 
> web.  DOWNLOAD SPLUNK!
>
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=103432&bid=230486&dat=121642
> _______________________________________________
> sleuthkit-users mailing list
>
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
> 


__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com