Re: [sleuthkit-users] TSK, GPT, and HFSJ

[Brian C. <ca...@sl...>]

Try using '-b 4096'.   Some of the iPods have a 4K sector size.


On May 13, 2013, at 10:17 AM, Terry Olson <twj...@ho...> wrote:

> I have a Cellebrite physical extraction of an iPod 4Gen.  I want to use TSK to gather all unallocated space (blkls), but can't figure out how to reference the partition within a GPT.  MMLS returns the dummy MBR partition table, which is of no help.  Using X-Ways to get the real partition offset, I entered that as -o, but that didn't work.  It returned Cannot determine file system type as an error.  Adding -f hfs, I get Invalid magic value (not an HFS+ file system (magic)).
> 
> Researching online, I am seeing hints that TSK supports GPT disks, but no examples that I can put to use.
> 
> I am using SIFT Workstation with TSK version 3.2.3 against a 8gb iPod 4g cellebrite physical extraction (.img file).
> 
> Any help would be appreciated.
> 
> Terry
> ------------------------------------------------------------------------------
> Learn Graph Databases - Download FREE O'Reilly Book
> "Graph Databases" is the definitive new guide to graph databases and 
> their applications. This 200-page book is written by three acclaimed 
> leaders in the field. The early access version is available now. 
> Download your free book today!http://p.sf.net/sfu/neotech_d2d_may_______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org