Re: [sleuthkit-users] Question about ifind and indirect blocks

[Nelson G. Mejias-D. <nel...@ne...>]

That's great! Thanks for taking the time to look into this.

Nelson

On Mon, 27 Feb 2006 23:05:11 -0400, Brian Carrier <ca...@sl...> wrote:

> You are correct.  I just fixed it (sf bug 1440075).  It also applied
> to indirect blocks for UFS.  I also fixed the duplicate messages.
>
> thanks!
> brian
>
>
> On Feb 24, 2006, at 1:00 PM, Nelson G. Mejias-Diaz wrote:
>
>> Hi Everyone,
>>
>> I'm new to this list and I have a question about ifind and indirect
>> blocks in ext2, using sleuthkit 2.03.  When I use the 'ifind' tool
>> and give an indirect block as an argument, to find its inode
>> number, I get an "Inode not found" message.  I want to know if the
>> tool is working correctly or if this indicates a bug.  I did
>> searches in Google and this mailing list but I haven't found an
>> answer for this.
>>
>> Here is the output of the command line call:
>>
>> [root@rush bin]# ./ifind -d 4361910 /dev/hda2
>> Inode not found
>> Inode not found
>>
>> where '4361910' is an indirect block number
>>
>>
>> I took this number from the output of the 'istat' command shown below.
>>
>> ------------ start of command output ------------
>>
>> [root@rush bin]# ./istat /dev/hda2 2180294
>> inode: 2180294
>> Allocated
>> Group: 133
>> Generation Id: 2672944929
>> uid / gid: 0 / 0
>> mode: -rw-r--r--
>> size: 613857
>> num of links: 1
>>
>> Inode Times:
>> Accessed:       Wed Jan 18 14:00:47 2006
>> File Modified:  Wed Jan 18 14:00:47 2006
>> Inode Modified: Wed Jan 18 14:00:47 2006
>>
>> Direct Blocks:
>> 4361893 4361894 4361895 4361896 4361897 4361898 4361899 4361900
>> 4361901 4361902 4361903 4361904 4361911 4361914 4361915 4361916
>> 4361917 4361918 4361919 4361920 4361921 4361922 4361923 4361924
>> 4361925 4361926 4361927 4361928 4361929 4361930 4361931 4361932
>> 4361933 4361934 4361937 4361938 4361939 4361940 4361941 4361942
>> 4361943 4361944 4362303 4362304 4362305 4362306 4362307 4362308
>> 4362309 4362310 4362311 4362312 4362313 4362314 4362315 4362316
>> 4362317 4362318 4362319 4362320 4362321 4362322 4362323 4362324
>> 4362325 4362326 4362407 4362408 4362409 4362410 4362411 4362412
>> 4362413 4362414 4362415 4362416 4362417 4362418 4362419 4362425
>> 4362426 4362427 4362428 4362429 4362430 4362431 4362432 4362433
>> 4362434 4362435 4362436 4362437 4362438 4362459 4362460 4362461
>> 4362462 4362463 4362464 4362465 4362466 4362467 4362468 4362472
>> 4362491 4362492 4362493 4362494 4362495 4362496 4362497 4362498
>> 4362499 4362500 4362501 4362502 4362503 4362504 4362505 4362506
>> 4362507 4362508 4362509 4362510 4362511 4362512 4362513 4362514
>> 4362515 4362516 4362517 4362518 4362519 4362521 4362522 4362523
>> 4362524 4362525 4362526 4362527 4362528 4362529 4362530 4362531
>> 4362532 4362533 4362534 4362535 4362536 4362537
>>
>> Indirect Blocks:
>> 4361910
>>
>



-- 
Nelson G. Mejias-Diaz
Director of Software Development
Netxar Technologies Inc.
phone: (787) 765-0058 ext 2009
email: nel...@ne...
website: www.netxar.com
--