Re: [sleuthkit-users] tsk_loaddb: Cannot determine file system type (Sector offset: 64, Partition T
Brought to you by:
carrier
Menu
▾
▴
Re: [sleuthkit-users] tsk_loaddb: Cannot determine file system type (Sector offset: 64, Partition Type: NTFS / exFAT (0x07))
|
From: Luís F. N. <lfc...@gm...> - 2016-06-06 21:44:51
|
Thank you, Ronaldo. I asked it to try to help tsk developers with deeper tsk knowledge (not me unfortunatelly) to solve the problem. Luis Nassif 2016-06-06 18:28 GMT-03:00 PCF Ronaldo R. Costa <ron...@dp...>: > Hi Nassif, > > It seems to be what tsk_loaddb detected, a partition NTFS with a volume > exFat. > > Follow mmls result and encase details about the problematic partition: > > === mmls === > DOS Partition Table > Offset Sector: 0 > Units are in 512-byte sectors > > Slot Start End Length Description > 000: Meta 0000000000 0000000000 0000000001 Primary Table (#0) > 001: ------- 0000000000 0000000063 0000000064 Unallocated > 002: 000:000 0000000064 3907024128 3907024065 NTFS / exFAT (0x07) > 003: ------- 3907024129 3907029167 0000005039 Unallocated > > > ===== Encase ========== > Serial Number 56D4-47DC > Driver Information exFAT 1.0 Used: 10% > Volume > File System exFat > Sectors per cluster 256 > Bytes per sector 512 > Total Sectors 3.907.024.065 > Total Capacity 2.000.396.222.464 Bytes (1,8 TB) > Total Clusters 15.261.812 > Unallocated 1.794.455.240.704 Bytes (1,6 TB) > Free Clusters 13.690.607 > Allocated 205.940.981.760 Bytes (191,8 GB) > Volume Offset 64 > Drive Type Fixed > Partition > Id 07 > Type NTFS > Start Sector 64 > Total Sectors 3.907.024.065 > > -- > Ronaldo Rosenau da Costa > Perito Criminal Federal > Setor Técnico Científico (SETEC) > Departamento de Polícia Federal - Paraná > Tel: (41) 3251-7651 > Voip: 4 4100-7651 > > -- > Ronaldo Rosenau da Costa > Perito Criminal Federal > Setor Técnico Científico (SETEC) > Departamento de Polícia Federal - Paraná > Tel: (41) 3251-7651 > Voip: 4 4100-7651 > > On 06/06/2016 17:26, Luís Filipe Nassif wrote: > > Hi Ronaldo, > > Do you know what is the true file system type? > > Regards, > Luis Nassif > > 2016-06-06 16:48 GMT-03:00 PCF Ronaldo R. Costa <ron...@dp...>: > >> Hi, >> >> tsk_loaddb.exe aborted with message below: >> Error: Cannot determine file system type (Sector offset: 64, Partition >> Type: NTFS / exFAT (0x07)) >> >> I can open this image with FTK and Encase, without any problem. >> >> Full verbose log is attached. >> >> Any suggestion? >> >> Regards, >> >> -- >> Ronaldo Rosenau da Costa >> Perito Criminal Federal >> Setor Técnico Científico (SETEC) >> Departamento de Polícia Federal - Paraná >> Tel: (41) 3251-7651 >> Voip: 4 4100-7651 >> >> >> >> ------------------------------------------------------------------------------ >> What NetFlow Analyzer can do for you? Monitors network bandwidth and >> traffic >> patterns at an interface-level. Reveals which users, apps, and protocols >> are >> consuming the most bandwidth. Provides multi-vendor support for NetFlow, >> J-Flow, sFlow and other flows. Make informed decisions using capacity >> planning reports. >> https://ad.doubleclick.net/ddm/clk/305295220;132659582;e >> _______________________________________________ >> sleuthkit-users mailing list >> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users >> http://www.sleuthkit.org >> >> > > > > ------------------------------------------------------------------------------ > What NetFlow Analyzer can do for you? Monitors network bandwidth and > traffic > patterns at an interface-level. Reveals which users, apps, and protocols > are > consuming the most bandwidth. Provides multi-vendor support for NetFlow, > J-Flow, sFlow and other flows. Make informed decisions using capacity > planning reports. https://ad.doubleclick.net/ddm/clk/305295220;132659582;e > _______________________________________________ > sleuthkit-users mailing list > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users > http://www.sleuthkit.org > > |
