[sleuthkit-users] dls rawfs_block_walk errors

[Mark K. M. <mar...@la...>]

Hi all,

I'm using Sleuthkit 2.03 and Autopsy 2.06 on Debian Linux (Sarge).  =
While extracting Unicode strings from an image, dls threw the following =
error:

/usr/local/sleuthkit/bin/dls: rawfs_block_walk: Error reading block at =
58605129: Success

It did the same thing during an ASCII string extraction, but I didn't =
note the exact error.  I checked the source (rawfs.c) and it looks like =
that error occurs when (surprise) there's a problem reading a block =
while iterating the blocks of the image.  I'm not sure exactly what the =
problem was, because I didn't rerun the dls command with the verbose =
option specified (I'm planning to, but it's time consuming and I haven't =
gotten to that yet).

My questions are:  When it comes to extracting strings, is it important =
that a block read error be a fatal error?  Currently it stops the string =
extraction (because dls quits).  I was thinking of making a small change =
to the source to keep iterating the blocks past a read error based on a =
command argument (an "ignore read errors" type switch).  Am I just =
getting myself into trouble here, or does doing something like this make =
sense?

Thanks,
Mark