sleuthkit-users

[sleuthkit-users] istat -b 2 gives blocks 0 0

[Ed <wh...@dm...>]

Hi

I'm trying to restore some files from an ext3 volume group (split into 3
image files) using http://www.sleuthkit.org/sleuthkit/docs/ref_fs.html as a
guide. Using fls finds me the directory I'm after:

d/d * 3637251:  shared/somedir

but if I perform:

istat -b 2 -f linux-ext3 -i split image1.dd image2.dd image3.dd 367251

istat returns:

Direct Blocks:
0 0

Which doesn't help me much.

Does anyone have any pointers on how to get this working

TIA

Ed

Re: [sleuthkit-users] istat -b 2 gives blocks 0 0

[Brian C. <ca...@sl...>]

On Jun 30, 2005, at 5:58 PM, Ed wrote:

> I'm trying to restore some files from an ext3 volume group (split into 
> 3
> image files) using http://www.sleuthkit.org/sleuthkit/docs/ref_fs.html 
> as a
> guide.

That guide uses Ext2 and not Ext3, the behavior changed.  I should add 
a note to it.

> istat returns:
>
> Direct Blocks:
> 0 0
>
> Which doesn't help me much.
>
> Does anyone have any pointers on how to get this working

It is working.  The block pointers are wiped with Ext3, so file-system 
based recovery won't help.

brian