[sleuthkit-users] istat question
Brought to you by:
carrier
From: Pasquale R. <pjr...@gm...> - 2017-09-27 06:29:48
|
Hello, I am working on a FAT32 thumb drive. fsstat shows a file has sectors 1716272-1716327 -> (EOF), when I run istat on the file, it lists sectors from 1716272-1716324 and has 0 0 0 for the last three sectors. I was wondering what the "0 0 0" means for the last three sectors. When looking at the data, those sectors contain data, so I wasn't sure whether that meant those sectors contain other data now or what. Thanks for any explanation, Pasquale |