Re: [sleuthkit-users] Question about ifind and indirect blocks

[Brian C. <ca...@sl...>]

You are correct.  I just fixed it (sf bug 1440075).  It also applied  
to indirect blocks for UFS.  I also fixed the duplicate messages.

thanks!
brian


On Feb 24, 2006, at 1:00 PM, Nelson G. Mejias-Diaz wrote:

> Hi Everyone,
>
> I'm new to this list and I have a question about ifind and indirect  
> blocks in ext2, using sleuthkit 2.03.  When I use the 'ifind' tool  
> and give an indirect block as an argument, to find its inode  
> number, I get an "Inode not found" message.  I want to know if the  
> tool is working correctly or if this indicates a bug.  I did  
> searches in Google and this mailing list but I haven't found an  
> answer for this.
>
> Here is the output of the command line call:
>
> [root@rush bin]# ./ifind -d 4361910 /dev/hda2
> Inode not found
> Inode not found
>
> where '4361910' is an indirect block number
>
>
> I took this number from the output of the 'istat' command shown below.
>
> ------------ start of command output ------------
>
> [root@rush bin]# ./istat /dev/hda2 2180294
> inode: 2180294
> Allocated
> Group: 133
> Generation Id: 2672944929
> uid / gid: 0 / 0
> mode: -rw-r--r--
> size: 613857
> num of links: 1
>
> Inode Times:
> Accessed:       Wed Jan 18 14:00:47 2006
> File Modified:  Wed Jan 18 14:00:47 2006
> Inode Modified: Wed Jan 18 14:00:47 2006
>
> Direct Blocks:
> 4361893 4361894 4361895 4361896 4361897 4361898 4361899 4361900
> 4361901 4361902 4361903 4361904 4361911 4361914 4361915 4361916
> 4361917 4361918 4361919 4361920 4361921 4361922 4361923 4361924
> 4361925 4361926 4361927 4361928 4361929 4361930 4361931 4361932
> 4361933 4361934 4361937 4361938 4361939 4361940 4361941 4361942
> 4361943 4361944 4362303 4362304 4362305 4362306 4362307 4362308
> 4362309 4362310 4362311 4362312 4362313 4362314 4362315 4362316
> 4362317 4362318 4362319 4362320 4362321 4362322 4362323 4362324
> 4362325 4362326 4362407 4362408 4362409 4362410 4362411 4362412
> 4362413 4362414 4362415 4362416 4362417 4362418 4362419 4362425
> 4362426 4362427 4362428 4362429 4362430 4362431 4362432 4362433
> 4362434 4362435 4362436 4362437 4362438 4362459 4362460 4362461
> 4362462 4362463 4362464 4362465 4362466 4362467 4362468 4362472
> 4362491 4362492 4362493 4362494 4362495 4362496 4362497 4362498
> 4362499 4362500 4362501 4362502 4362503 4362504 4362505 4362506
> 4362507 4362508 4362509 4362510 4362511 4362512 4362513 4362514
> 4362515 4362516 4362517 4362518 4362519 4362521 4362522 4362523
> 4362524 4362525 4362526 4362527 4362528 4362529 4362530 4362531
> 4362532 4362533 4362534 4362535 4362536 4362537
>
> Indirect Blocks:
> 4361910
>