Thread: [sleuthkit-developers] [ sleuthkit-Bugs-2874854 ] iPod Partition Table
Brought to you by:
carrier
From: SourceForge.net <no...@so...> - 2009-10-08 17:10:05
|
Bugs item #2874854, was opened at 2009-10-08 12:10 Message generated for change (Tracker Item Submitted) made by carrier You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2874854&group_id=55685 Please note that this message will contain a full copy of the comment thread, including the initial issue submission, for this request, not just the latest update. Category: Media Management Tools Group: None Status: Open Resolution: None Priority: 5 Private: No Submitted By: Brian Carrier (carrier) Assigned to: Nobody/Anonymous (nobody) Summary: iPod Partition Table Initial Comment: An iPod image seems to be using 4096-byte sectors and TSK does not recognize the Mac partition table. Using '-o 0@4096' does not help. This needs to be resolved. Reported by Simson Garfinkel. There seem to be a couple of issues: - The sector size from the command line should be pushed through all of the code (instead of assuming a 512-byte sector). - It seems that if you give a 0@XXX value for '-o', then it ignores the sector size. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2874854&group_id=55685 |
From: SourceForge.net <no...@so...> - 2009-10-08 17:12:12
|
Bugs item #2874854, was opened at 2009-10-08 12:10 Message generated for change (Comment added) made by carrier You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2874854&group_id=55685 Please note that this message will contain a full copy of the comment thread, including the initial issue submission, for this request, not just the latest update. Category: Media Management Tools Group: None Status: Open Resolution: None Priority: 5 Private: No Submitted By: Brian Carrier (carrier) Assigned to: Nobody/Anonymous (nobody) Summary: iPod Partition Table Initial Comment: An iPod image seems to be using 4096-byte sectors and TSK does not recognize the Mac partition table. Using '-o 0@4096' does not help. This needs to be resolved. Reported by Simson Garfinkel. There seem to be a couple of issues: - The sector size from the command line should be pushed through all of the code (instead of assuming a 512-byte sector). - It seems that if you give a 0@XXX value for '-o', then it ignores the sector size. ---------------------------------------------------------------------- >Comment By: Brian Carrier (carrier) Date: 2009-10-08 12:12 Message: Note that this also seems to apply to the file system in the image that Simson shared. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2874854&group_id=55685 |
From: SourceForge.net <no...@so...> - 2009-10-28 21:02:36
|
Bugs item #2874854, was opened at 2009-10-08 12:10 Message generated for change (Settings changed) made by carrier You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2874854&group_id=55685 Please note that this message will contain a full copy of the comment thread, including the initial issue submission, for this request, not just the latest update. Category: Media Management Tools Group: None >Status: Closed >Resolution: Fixed Priority: 5 Private: No Submitted By: Brian Carrier (carrier) Assigned to: Nobody/Anonymous (nobody) Summary: iPod Partition Table Initial Comment: An iPod image seems to be using 4096-byte sectors and TSK does not recognize the Mac partition table. Using '-o 0@4096' does not help. This needs to be resolved. Reported by Simson Garfinkel. There seem to be a couple of issues: - The sector size from the command line should be pushed through all of the code (instead of assuming a 512-byte sector). - It seems that if you give a 0@XXX value for '-o', then it ignores the sector size. ---------------------------------------------------------------------- >Comment By: Brian Carrier (carrier) Date: 2009-10-28 16:02 Message: This is now fixed on the trunk. '-b' can be used to specify the sector size and this value is carried into all code instead of always assuming 512. Also removed support for specifying offset using '63@4096' format. The offset is now only a sector and the sector size is given via -b (if it is not 512). Need to add code to query AFFLIB for sector size. ---------------------------------------------------------------------- Comment By: Brian Carrier (carrier) Date: 2009-10-08 12:12 Message: Note that this also seems to apply to the file system in the image that Simson shared. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2874854&group_id=55685 |