Re: [sleuthkit-users] Error: Cannot determine file system type (Sector offset: 0)

[Brian C. <ca...@sl...>]

Hi Luis,

It looks like it can’t differentiate between it having a DOS or Mac partition table. Though, it should be able to because the only Mac partition it found had a size of 0 sectors.  Code in github has a fix.    

Are you building from source or an installed version.  It unfortunately looks like tsk_loaddb doesn’t allow you to specify the partition type when this kind of situation occurs. 

thanks,
brian





> On Dec 17, 2015, at 6:38 AM, Luís Filipe Nassif <lfc...@gm...> wrote:
> 
> Hi,
> 
> Tsk_Loaddb (4.2 and 4.1.3) is reporting that error message with some FAT32 thumbdrive images. We can open and browse the file system content with other forensic tools.
> 
> One mmls -v output is below:
> 
> tsk_img_open: Type: 0   NumImg: 1  Img1: /media/sf_F_DRIVE/Imagens/pendrive/unknownFS/Item06ItemArrecadacao08.E01
> ewf_open: found 1 segment files via libewf_glob
> dos_load_prim: Table Sector: 0
> ewf_image_read: byte offset: 0 len: 65536
> dos_load_prim_table: Testing FAT/NTFS conditions
> load_pri:0:0    Start: 63   Size: 7830081  Type: 11
> load_pri:0:1    Start: 0   Size: 0  Type: 0
> load_pri:0:2    Start: 0   Size: 0  Type: 0
> load_pri:0:3    Start: 0   Size: 0  Type: 0
> bsd_load_table: Table Sector: 1
> gpt_load_table: Sector: 0
> gpt_open: Trying other sector sizes
> gpt_open: Trying sector size: 512
> gpt_load_table: Sector: 0
> gpt_open: Trying sector size: 1024
> gpt_load_table: Sector: 0
> gpt_open: Trying sector size: 2048
> gpt_load_table: Sector: 0
> gpt_open: Trying sector size: 4096
> gpt_load_table: Sector: 0
> gpt_open: Trying sector size: 8192
> gpt_load_table: Sector: 0
> sun_load_table: Trying sector: 0
> sun_load_table: Trying sector: 1
> mac_load_table: Sector: 1
> mac_load: 0  Starting Sector: 0  Size: 0 Type:  Status: 0
> Cannot determine partition type (Mac or DOS at 0)
> 
> I will gladly provide any other information requested to help indentify the problem. I can also share (the whole or part of) one of those images in ewf format.
> 
> Any help will be very much appreciated.
> 
> Thank you,
> Luis Nassif
> ------------------------------------------------------------------------------
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org