[sleuthkit-users] Error: Cannot determine file system type (Sector offset: 0)

[Luís F. N. <lfc...@gm...>]

Hi,

Tsk_Loaddb (4.2 and 4.1.3) is reporting that error message with some FAT32
thumbdrive images. We can open and browse the file system content with
other forensic tools.

One mmls -v output is below:

tsk_img_open: Type: 0   NumImg: 1  Img1:
/media/sf_F_DRIVE/Imagens/pendrive/unknownFS/Item06ItemArrecadacao08.E01
ewf_open: found 1 segment files via libewf_glob
dos_load_prim: Table Sector: 0
ewf_image_read: byte offset: 0 len: 65536
dos_load_prim_table: Testing FAT/NTFS conditions
load_pri:0:0    Start: 63   Size: 7830081  Type: 11
load_pri:0:1    Start: 0   Size: 0  Type: 0
load_pri:0:2    Start: 0   Size: 0  Type: 0
load_pri:0:3    Start: 0   Size: 0  Type: 0
bsd_load_table: Table Sector: 1
gpt_load_table: Sector: 0
gpt_open: Trying other sector sizes
gpt_open: Trying sector size: 512
gpt_load_table: Sector: 0
gpt_open: Trying sector size: 1024
gpt_load_table: Sector: 0
gpt_open: Trying sector size: 2048
gpt_load_table: Sector: 0
gpt_open: Trying sector size: 4096
gpt_load_table: Sector: 0
gpt_open: Trying sector size: 8192
gpt_load_table: Sector: 0
sun_load_table: Trying sector: 0
sun_load_table: Trying sector: 1
mac_load_table: Sector: 1
mac_load: 0  Starting Sector: 0  Size: 0 Type:  Status: 0
Cannot determine partition type (Mac or DOS at 0)

I will gladly provide any other information requested to help indentify the
problem. I can also share (the whole or part of) one of those images in ewf
format.

Any help will be very much appreciated.

Thank you,
Luis Nassif