Re: [sleuthkit-users] (no subject)

[<gim...@we...>]

On Tue, 28 Mar 2006 16:00:22 -0500
Carlton Foster <c.a...@la...> wrote:

> mmls -V
> The Sleuthkit ver 2.01
> 
> mmls -t dos -i raw <host>.img
> mmls: Invalid extended partition table magic in sector 18201645
> 
> file <host>.img
> <host>.img: x86 boot sector
> 
>   fdisk -lu <host>.img
> You must set cylinders.
> You can do this from the extra functions menu.
> Warning: ignoring extra data in partition table 5
> Warning: ignoring extra data in partition table 5
> Warning: ignoring extra data in partition table 5
> Warning: invalid flag 0xffffd366 of partition table 5 will be 
> corrected by w(rite)
> 
> Disk <host>.img: 0 MB, 0 bytes
> 255 heads, 63 sectors/track, 0 cylinders, total 0 sectors
> Units = sectors of 1 * 512 = 512 bytes
> 
>      Device Boot      Start         End      Blocks   Id  System
> 54_21.img1   *          63    18201644     9100791    7  HPFS/NTFS
> Partition 1 has different physical/logical endings:
>       phys=(1023, 254, 63) logical=(1132, 254, 63)
> 54_21.img2        18201645    58605119    20201737+   f  W95 Ext'd
> (LBA) Partition 2 has different physical/logical beginnings
> (non-Linux?): phys=(1023, 0, 1) logical=(1133, 0, 1)
> Partition 2 has different physical/logical endings:
>       phys=(1023, 254, 63) logical=(3647, 254, 63)
> 54_21.img5   ?  1358216596  4227304473  1434543939   6b  Unknown
> You must set cylinders.

What would be result setting  logical geometry to (1023, 254, 63) for partition 1? Something you might try out.