Re: [sleuthkit-users] Error: Cannot determine file system type (Sector offset: 0)

[Luís F. N. <lfc...@gm...>]

Hi Brian,

Thank you very much for your attention. I am building from source. The fix
resolved the issue like a charm, tested with 2 problematic thumbdrives I
still have with me.

Thank you again,
Luis

2015-12-17 14:06 GMT-02:00 Brian Carrier <ca...@sl...>:

> Hi Luis,
>
> It looks like it can’t differentiate between it having a DOS or Mac
> partition table. Though, it should be able to because the only Mac
> partition it found had a size of 0 sectors.  Code in github has a fix.
>
> Are you building from source or an installed version.  It unfortunately
> looks like tsk_loaddb doesn’t allow you to specify the partition type when
> this kind of situation occurs.
>
> thanks,
> brian
>
>
>
>
>
> > On Dec 17, 2015, at 6:38 AM, Luís Filipe Nassif <lfc...@gm...>
> wrote:
> >
> > Hi,
> >
> > Tsk_Loaddb (4.2 and 4.1.3) is reporting that error message with some
> FAT32 thumbdrive images. We can open and browse the file system content
> with other forensic tools.
> >
> > One mmls -v output is below:
> >
> > tsk_img_open: Type: 0   NumImg: 1  Img1:
> /media/sf_F_DRIVE/Imagens/pendrive/unknownFS/Item06ItemArrecadacao08.E01
> > ewf_open: found 1 segment files via libewf_glob
> > dos_load_prim: Table Sector: 0
> > ewf_image_read: byte offset: 0 len: 65536
> > dos_load_prim_table: Testing FAT/NTFS conditions
> > load_pri:0:0    Start: 63   Size: 7830081  Type: 11
> > load_pri:0:1    Start: 0   Size: 0  Type: 0
> > load_pri:0:2    Start: 0   Size: 0  Type: 0
> > load_pri:0:3    Start: 0   Size: 0  Type: 0
> > bsd_load_table: Table Sector: 1
> > gpt_load_table: Sector: 0
> > gpt_open: Trying other sector sizes
> > gpt_open: Trying sector size: 512
> > gpt_load_table: Sector: 0
> > gpt_open: Trying sector size: 1024
> > gpt_load_table: Sector: 0
> > gpt_open: Trying sector size: 2048
> > gpt_load_table: Sector: 0
> > gpt_open: Trying sector size: 4096
> > gpt_load_table: Sector: 0
> > gpt_open: Trying sector size: 8192
> > gpt_load_table: Sector: 0
> > sun_load_table: Trying sector: 0
> > sun_load_table: Trying sector: 1
> > mac_load_table: Sector: 1
> > mac_load: 0  Starting Sector: 0  Size: 0 Type:  Status: 0
> > Cannot determine partition type (Mac or DOS at 0)
> >
> > I will gladly provide any other information requested to help indentify
> the problem. I can also share (the whole or part of) one of those images in
> ewf format.
> >
> > Any help will be very much appreciated.
> >
> > Thank you,
> > Luis Nassif
> >
> ------------------------------------------------------------------------------
> > _______________________________________________
> > sleuthkit-users mailing list
> > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> > http://www.sleuthkit.org
>
>