[sleuthkit-users] No inode found for some blocks reported as allocated by blkstat.
Brought to you by:
carrier
From: <slo...@gm...> - 2016-08-30 00:38:49
|
I have an artifact of interest in block 6713248 of a partition (here represented with the variable $p4). The blkstat tool and the results of blkls -el both indicate the block is allocated. $ blkstat $p4 6713248 > Cluster: 6713248 > Allocated > However, when I use ifind to determine the associated metadata structure, no inode can be found: $ ifind $p4 -d 6713248 > Inode not found > Is this a bug? How do I determine the associated file/meta data structure without ifind? Thanks, John Platform: Linux TSK v. 4.3.0 and 4.2.0 |