Re: [sleuthkit-users] blkcat usage on text file

[Simson G. <si...@ac...>]

Kai,

From your example, it's possible that the data buffer hasn't been flushed to the disk.  Try running 'sync' before doing the blkcat.

Also, you cut out a step by using icat:
	# icat /dev/sdb1 12

Simson


> On Jan 24, 2015, at 11:33 AM, Kai Pöritz <ka...@po...> wrote:
> 
> Hello sleuthkit folks,
> 
> I try do display the content of a text file with the help of blkcat. But
> the output is none.
> 
> # cat /mnt/not-encrypted-disk/sensitive-file.txt sensitive text
> # ls -li /mnt/not-encrypted-disk/sensitive-file.txt
> 12 -rw-r--r-- 1 root root 15 Jan 24 17:15
> /mnt/not-encrypted-disk/sensitive-file.txt
> # istat /dev/sdb1 12
> inode: 12
> Allocated
> Group: 0
> Generation Id: 2192492698
> uid / gid: 0 / 0
> mode: rrw-r--r--
> Flags:
> size: 15
> num of links: 1
> 
> Inode Times:
> Accessed:   2015-01-24 17:15:58 (CET)
> File Modified:  2015-01-24 17:15:27 (CET)
> Inode Modified: 2015-01-24 17:15:27 (CET)
> 
> Direct Blocks:
> 127754
> # blkcat /dev/sdb1 127754
> #
> 
> 
> Souldn't 'blkcat /dev/sdb1 127754 ' display the content of the file? How
> do I blkcat the content of the file? Thanks in advance.
> 
> ------------------------------------------------------------------------------
> New Year. New Location. New Benefits. New Data Center in Ashburn, VA.
> GigeNET is offering a free month of service with a new server in Ashburn.
> Choose from 2 high performing configs, both with 100TB of bandwidth.
> Higher redundancy.Lower latency.Increased capacity.Completely compliant.
> http://p.sf.net/sfu/gigenet_______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org