[sleuthkit-users] Bug in the icat command into sleuthkit-4.1.0 version for EXT4 support

[Maikel A. <mai...@gm...>]

Hi all:

I'm testing the 4.1.0 version of sleuthkit and I think I've found a bug.

I've compiled the sources downloaded from

http://sourceforge.net/projects/sleuthkit/files/sleuthkit/4.1.0/sleuthkit-4.1.0.tar.gz/download

and then when I use the command

# fls -f ext4 -dpFrl /dev/sda3 on my Ubuntu 13.04 64bits



I get correctly many line with information about deleted files

all lines are like

r/r * 483647:    home/mainu/Imágenes/IMG_
20121114_190334.jpg    2013-09-05 07:12:50 (CEST)    2013-09-03 23:05:13
(CEST)    2013-09-05 07:12:50 (CEST)    2012-11-19 16:16:30 (CET)    0
1000    1000

but problem is when I run the command

./icat -f ext4 -r /dev/sda3 483647 >picture.jpg

for any deleted file when I run an icat command like this I'm getting this
error message

Invalid API argument (tsk_fs_attrlist_get: Null list pointer)

and nothing is recovered.

This is not happening for fat deleted files. They are recovered correctly.

Is there a bug in the ext4 support? What do you think?

Thanks in advance.
Makelen