sleuthkit-users

[sleuthkit-users] File too large, Fat32

[<fu...@gm...>]

Hi list members

I got a problem with an image of a Fat32-Image.

The situation:
An image of an external usb harddrive, formated with FAT (mounted as a
loopback, mount shows vfat). On the disk are some backup-files from MyBackup
PC from Stomp. 

The problem:
3 of the 4 Backup files are broken, but one is still complete (hope so). Is
has a size of 4 gigabyte when I take a look at it via Windows or via mounted
loopback device. But if load the image to autopsy (2.0.0), the file looks
like this:

Name:
120404.qic	  	

Written:
2004.04.12 16:42:18 (CEST)

Modified:
2004.05.27 00:00:00 (CEST)

Created:
2004.04.12 16:42:18 (CEST)

Size:
18446744073709546496

Meta:
164

Obviously, the file size is wrong here. I don't know any USB drive with such
size. when I take a look at the file content I see nothing also got File
Type: empty. Exporting also does not work. I'm now wondering what happens
here?

I mounted the image as FAT32. With the other FAT's I had no access. 

There are also two other huge files which are NOT allocated. There happens
the same. Of course I'm interested in their content. The size of these files
are 
ackup.bkf (_ACKUP.BKF): 18446744073709523968
_Za03576 (_ZA03576): 18446744073709155022
Also both impossible size.

I read assuming the real size of a file under FAT is very hard, is this the
case here? Any hope to get the deleted files (other tools e.g.)?

thank you 

Fuerst


-- 
"Sie haben neue Mails!" - Die GMX Toolbar informiert Sie beim Surfen!
Jetzt aktivieren unter http://www.gmx.net/info

Re: [sleuthkit-users] File too large, Fat32

[Brian C. <ca...@sl...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Jun 4, 2004, at 10:42 AM, fu...@gm... wrote:

> Hi list members
>
> I got a problem with an image of a Fat32-Image.

...

> Size:
> 18446744073709546496
>
> Obviously, the file size is wrong here.

Hmmm.  There is a casting problem going on between internal storage 
sizes.  What OS are you using?  The current version of TSK uses some 
platform-dependent variable sizes, which leads these problems.

brian
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFAwPajOK1gLsdFTIsRAiB6AJ4tmECT4RxSc/apTf/8bGSafKTJhwCeJnaF
9prvLJAXlGYlW+35aEl9nLA=
=7wQp
-----END PGP SIGNATURE-----

Re: [sleuthkit-users] File too large, Fat32

[<fu...@gm...>]

> > Hi list members
> >
> > I got a problem with an image of a Fat32-Image.
> 
> ...
> 
> > Size:
> > 18446744073709546496
> >
> > Obviously, the file size is wrong here.
> 
> Hmmm.  There is a casting problem going on between internal storage 
> sizes.  What OS are you using?  The current version of TSK uses some 
> platform-dependent variable sizes, which leads these problems.
> 

Autopsy and sleuthkit are running on a Debian Linux Woody System with kernel
2.4.19, gcc 2.95.4.

Can I provide you with any other usefull information?

regards

Fuerst

-- 
"Sie haben neue Mails!" - Die GMX Toolbar informiert Sie beim Surfen!
Jetzt aktivieren unter http://www.gmx.net/info

Re: [sleuthkit-users] File too large, Fat32

[Brian C. <ca...@ce...>]

[I sent this last week, but it was never posted because of the SPAM 
list issue.  Here it is again.]


On Jun 10, 2004, at 11:23 AM, Brian Carrier wrote:

> To finish this thread, the issue has been resolved (BUG 966839).  If 
> your system is showing the same behavior for large FAT files, let me 
> know and I'll send you the fix.  Otherwise, it will be in the next 
> version.
>
> Thanks to Fuerst for helping to debug this.
>
> brian
>
>
>
>
> On Jun 7, 2004, at 2:29 AM, fu...@gm... wrote:
>
>>>> Hi list members
>>>>
>>>> I got a problem with an image of a Fat32-Image.
>>>
>>> ...
>>>
>>>> Size:
>>>> 18446744073709546496
>>>>
>>>> Obviously, the file size is wrong here.
>