Re: [sleuthkit-users] tsk_loaddb: Cannot determine file system type (Sector offset: 64, Partition T
Brought to you by:
carrier
Menu
▾
▴
Re: [sleuthkit-users] tsk_loaddb: Cannot determine file system type (Sector offset: 64, Partition Type: NTFS / exFAT (0x07))
|
From: PCF R. R. C. <ron...@dp...> - 2016-06-06 21:28:52
|
Hi Nassif,
It seems to be what tsk_loaddb detected, a partition NTFS with a volume
exFat.
Follow mmls result and encase details about the problematic partition:
=== mmls ===
DOS Partition Table
Offset Sector: 0
Units are in 512-byte sectors
Slot Start End Length Description
000: Meta 0000000000 0000000000 0000000001 Primary Table (#0)
001: ------- 0000000000 0000000063 0000000064 Unallocated
002: 000:000 0000000064 3907024128 3907024065 NTFS / exFAT (0x07)
003: ------- 3907024129 3907029167 0000005039 Unallocated
===== Encase ==========
Serial Number 56D4-47DC
Driver Information exFAT 1.0 Used: 10%
Volume
File System exFat
Sectors per cluster 256
Bytes per sector 512
Total Sectors 3.907.024.065
Total Capacity 2.000.396.222.464 Bytes (1,8 TB)
Total Clusters 15.261.812
Unallocated 1.794.455.240.704 Bytes (1,6 TB)
Free Clusters 13.690.607
Allocated 205.940.981.760 Bytes (191,8 GB)
Volume Offset 64
Drive Type Fixed
Partition
Id 07
Type NTFS
Start Sector 64
Total Sectors 3.907.024.065
--
Ronaldo Rosenau da Costa
Perito Criminal Federal
Setor Técnico Científico (SETEC)
Departamento de Polícia Federal - Paraná
Tel: (41) 3251-7651
Voip: 4 4100-7651
--
Ronaldo Rosenau da Costa
Perito Criminal Federal
Setor Técnico Científico (SETEC)
Departamento de Polícia Federal - Paraná
Tel: (41) 3251-7651
Voip: 4 4100-7651
On 06/06/2016 17:26, Luís Filipe Nassif wrote:
> Hi Ronaldo,
>
> Do you know what is the true file system type?
>
> Regards,
> Luis Nassif
>
> 2016-06-06 16:48 GMT-03:00 PCF Ronaldo R. Costa
> <ron...@dp... <mailto:ron...@dp...>>:
>
> Hi,
>
> tsk_loaddb.exe aborted with message below:
> Error: Cannot determine file system type (Sector offset: 64,
> Partition Type: NTFS / exFAT (0x07))
>
> I can open this image with FTK and Encase, without any problem.
>
> Full verbose log is attached.
>
> Any suggestion?
>
> Regards,
>
> --
> Ronaldo Rosenau da Costa
> Perito Criminal Federal
> Setor Técnico Científico (SETEC)
> Departamento de Polícia Federal - Paraná
> Tel: (41) 3251-7651 <tel:%2841%29%203251-7651>
> Voip: 4 4100-7651
>
>
> ------------------------------------------------------------------------------
> What NetFlow Analyzer can do for you? Monitors network bandwidth
> and traffic
> patterns at an interface-level. Reveals which users, apps, and
> protocols are
> consuming the most bandwidth. Provides multi-vendor support for
> NetFlow,
> J-Flow, sFlow and other flows. Make informed decisions using capacity
> planning reports.
> https://ad.doubleclick.net/ddm/clk/305295220;132659582;e
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>
>
|
