Re: [sleuthkit-users] dls rawfs_block_walk errors

[Brian C. <ca...@sl...>]

What is the size (in bytes) of the file  you are reading?  I guess  
this error could occur if your file is not a multiple of 512-bytes.   
Did you import the file image as a rawfs?

brian



On May 25, 2006, at 12:08 AM, Mark K. Murdock wrote:

> Hi all,
>
> I'm using Sleuthkit 2.03 and Autopsy 2.06 on Debian Linux (Sarge).   
> While extracting Unicode strings from an image, dls threw the  
> following error:
>
> /usr/local/sleuthkit/bin/dls: rawfs_block_walk: Error reading block  
> at 58605129: Success
>
> It did the same thing during an ASCII string extraction, but I  
> didn't note the exact error.  I checked the source (rawfs.c) and it  
> looks like that error occurs when (surprise) there's a problem  
> reading a block while iterating the blocks of the image.  I'm not  
> sure exactly what the problem was, because I didn't rerun the dls  
> command with the verbose option specified (I'm planning to, but  
> it's time consuming and I haven't gotten to that yet).
>
> My questions are:  When it comes to extracting strings, is it  
> important that a block read error be a fatal error?  Currently it  
> stops the string extraction (because dls quits).  I was thinking of  
> making a small change to the source to keep iterating the blocks  
> past a read error based on a command argument (an "ignore read  
> errors" type switch).  Am I just getting myself into trouble here,  
> or does doing something like this make sense?
>
> Thanks,
> Mark
>