Re: [sleuthkit-users] What's the difference between foremost and manual extraction using dd and sleuthkit?

[Geert V. A. <gee...@pa...>]

Jelle S. wrote:
> Hi list,

> why do I need to count 103 sectors? Shouldn't I based upon the output of 
> the istat command only count 101 sectors?
> quid?

Maybe because foremost takes the whole last block/cluster which is 
allocated to that file (fat12, 8 sectors/cluster)? In your dd 
extraction, you would indeed have the content of the file, but not all 
the slack space.

--
Geert VAN ACKER