sleuthkit-users

[sleuthkit-users] fls ext2fs_dinode_lookup error

[Ed <wh...@dm...>]

Hi

I'm trying to recover some deleted files from an ext3 volume group spanned
across 2 physical disks on a CentOS 4 system.  I've done a dd of the
volgroup (/dev/mapper/VolGroup00-LogVol00), but when I try to fls this image
(fls -f linux-ext3 -d image.dd) I get the following error:

/usr/local/sleuthkit/bin/fls: ext2fs_dinode_lookup: Error reading inode
386305 from 322233664

This error is also output to the autopsy console when doing file analysis
(which doesn't correctly list the contents of the partition)

Also fsstat gives a similar error from the 'image details' page in autopsy.

My suspicion is that this is something to do with the volume group, but I
can't find any suggestions on Google or the mailing list.

Can anyone provide any pointers on how to get this to work?

Many thanks

Ed

Re: [sleuthkit-users] fls ext2fs_dinode_lookup error

[Brian C. <ca...@sl...>]

On Jun 6, 2005, at 5:13 PM, Ed wrote:

> Hi
>
> I'm trying to recover some deleted files from an ext3 volume group 
> spanned
> across 2 physical disks on a CentOS 4 system.  I've done a dd of the
> volgroup (/dev/mapper/VolGroup00-LogVol00), but when I try to fls this 
> image
> (fls -f linux-ext3 -d image.dd) I get the following error:
>
> /usr/local/sleuthkit/bin/fls: ext2fs_dinode_lookup: Error reading inode
> 386305 from 322233664

This error occurs when it tries to read part of the image file that 
does not exist because the file is too small.  Are you sure the image 
file is the same size as the original spanned volume? Can you send me 
the first 25 or 30 lines of running fsstat on it?  Can you mount it 
read only using loopback?

brian

RE: [sleuthkit-users] fls ext2fs_dinode_lookup error

[Ed <wh...@dm...>]

Thanks for the response, I was about to send a detailed email full of df's
fdisk -l's etc, but then I remembered that I was accessing the image through
a samba share to an XP machine, so I thought I'd try copying it onto the
local filesystem and suddenly all works :)  It's always the silly things
that get you.

I don't care too much now really, and this is probably more a samba question
now, but shouldn't it work OK with a samba share? I can imagine plenty of
scenarios where you don't have linux installs with large amounts of hdd
space (e.g. running of a 'live' distro/toolkit) when it would be very
helpful.

Thanks

Ed
-----Original Message-----
From: sle...@li...
[mailto:sle...@li...] On Behalf Of Brian
Carrier
Sent: 07 June 2005 15:37
To: Ed
Cc: sle...@li...
Subject: Re: [sleuthkit-users] fls ext2fs_dinode_lookup error


On Jun 6, 2005, at 5:13 PM, Ed wrote:

> Hi
>
> I'm trying to recover some deleted files from an ext3 volume group 
> spanned
> across 2 physical disks on a CentOS 4 system.  I've done a dd of the
> volgroup (/dev/mapper/VolGroup00-LogVol00), but when I try to fls this 
> image
> (fls -f linux-ext3 -d image.dd) I get the following error:
>
> /usr/local/sleuthkit/bin/fls: ext2fs_dinode_lookup: Error reading inode
> 386305 from 322233664

This error occurs when it tries to read part of the image file that 
does not exist because the file is too small.  Are you sure the image 
file is the same size as the original spanned volume? Can you send me 
the first 25 or 30 lines of running fsstat on it?  Can you mount it 
read only using loopback?

brian



-------------------------------------------------------
This SF.Net email is sponsored by: NEC IT Guy Games.  How far can you
shotput
a projector? How fast can you ride your desk chair down the office luge
track?
If you want to score the big prize, get to know the little guy.  
Play to win an NEC 61" plasma display: http://www.necitguy.com/?r=20
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org

Re: [sleuthkit-users] fls ext2fs_dinode_lookup error

[Angus M. <an...@n-...>]

On Wednesday 08 June 2005 00:38, Ed wrote:
<snip>
> I don't care too much now really, and this is probably more a samba
> question now, but shouldn't it work OK with a samba share? I can imagine
> plenty of scenarios where you don't have linux installs with large amounts
> of hdd space (e.g. running of a 'live' distro/toolkit) when it would be
> very helpful.
>
> Thanks
>
> Ed

ISTR going through this problem a few months ago - I think Samba suffers from 
a 2Gb file size limit so even if the file shows up, you can only access the 
first 2Gb - anyone know the current situation ? My "solution" to it is to 
keep some USB-IDE adapters around so I can attach drives directly to the 
analysis station.