Re: [sleuthkit-users] Error in sorter - what am I missing?

[Jennifer S. <g33...@li...>]

Ok, I got the offset from mmls (thanks Barry, that was exactly what I neede=
d to do!) and now sorter is running beautifully, with just one hangup.

It appears that there are some file system compressed files in this image a=
nd when sorter gets to them it throws out an error that it can not access N=
TFS compressed files and then it aborts trying to access that particular fi=
le. These appear to be file system compressed files, not standard archive f=
iles, since it was able to sort and catalog .cab, .dat, and .zip files with=
 no problem.

According to some research on this end, it seems that NTFS uses something s=
imilar to DriveSpace3 for it's compression (please correct me if I'm wrong)=
 - has anyone found/created any method to work through this error with sort=
er so that instead of aborting the file, it uncompresses it and sorts it as=
 intended?

farmer dude, thanks for the response - any suggestions on sites to look for=
 practice images (especially if they include a "results" list, so I know if=
 I actually find everything); also, is there a how-to anywhere on creating =
images for practicing?

Thanks again for all the help,
gg




--=20
_______________________________________________
Check out the latest SMS services @ http://www.linuxmail.org
This allows you to send and receive SMS through your mailbox.

Powered by Outblaze