Re: [sleuthkit-users] Linux and "unrecognized" sectors

[Paul S. <pa...@vn...>]

Thanks everyone!

Paul

farmer dude wrote:

>Hi Paul,
>
>Linux doesn't access the last odd sector when
>initializing file systems and so the article you read
>probably indicated using Linux to acquire may leave
>the last sector if the count is odd or similar.  
>
>This is true for the 2.4 Linux kernel because the
>block layer uses 1024 and a sector is 512, so it
>cannot be accessed when going through the block layer
>(such as 'dd' does when dumping a device).  The block
>layer was rewritten in the 2.6 kernel so a 2.6 can
>access this last odd sector for those Windows file
>system types that use it.  
>
>A side note, you can happily acquire that sector using
>the 2.4 Linux kernel, too.  Just avoid the block layer
>and use the raw device.  I do this when I need to and
>teach about it in my training classes.  You don't need
>a 2.6 kernel to get the last odd sector.  You only
>need to know what the problem is and how to work
>around it in the 2.4 series kernels.
>
>
>regards,
>
>farmerdude
>
>http://www.farmerdude.com/
>
>
>
>--- Paul Stillwell <pa...@vn...> wrote:
>
>  
>
>>Hello all,
>>
>>    I'm reading some articles and one that I have
>>come across (was 
>>handed to me unfortunately no link) and it says that
>>Linux will not 
>>recognize the last sector of a disk if it has an odd
>>number of sectors.  
>>I had never heard this before and it has prompted a
>>couple of questions.
>>
>>1)  will this affect an image acquired using dd?
>>
>>2)  will it affect Sleuthkit's handling of an image
>>of this drive?
>>
>>Thanks!
>>
>>Paul
>>
>>
>>
>>    
>>
>-------------------------------------------------------
>  
>
>>This SF.net email is sponsored by: Splunk Inc. Do
>>you grep through log files
>>for problems?  Stop!  Download the new AJAX search
>>engine that makes
>>searching your log files as easy as surfing the 
>>web.  DOWNLOAD SPLUNK!
>>
>>    
>>
>http://sel.as-us.falkag.net/sel?cmd=lnk&kid=103432&bid=230486&dat=121642
>  
>
>>_______________________________________________
>>sleuthkit-users mailing list
>>
>>    
>>
>https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>  
>
>>http://www.sleuthkit.org
>>
>>    
>>
>
>
>__________________________________________________
>Do You Yahoo!?
>Tired of spam?  Yahoo! Mail has the best spam protection around 
>http://mail.yahoo.com 
>
>  
>