sleuthkit-users

[sleuthkit-users] File system detection issue with fsstat

[Jaime C. <jc...@id...>]

Hi all,

I run the fsstat command against an ext3 hard drive partition and I got 
the following error:

   fsstat: Cannot determine if EXT2/3 or FAT

I am wondering if any of you guys have seen this before. Is this an 
isolated case?... What are the probabilities that fsstat can not detect 
the supported file systems?

This is the output I get if I run fsstat -f fat against the same 
partition. Note: there is an error at the end...

FILE SYSTEM INFORMATION
--------------------------------------------
File System Type: FAT32

OEM Name: MSDOS5.0
Volume ID: 0x7d2041b
Volume Label (Boot Sector): NO NAME
Volume Label (Root Directory):
File System Type Label: FAT32
Next Free Sector (FS Info): 4294986352
Free Sector Count (FS Info): 0

Sectors before file system: 63

File System Layout (in sectors)
Total Range: 0 - 39086081
* Reserved: 0 - 31
** Boot Sector: 0
** FS Info Sector: 1
** Backup Boot Sector: 6
* FAT 0: 32 - 9575
* FAT 1: 9576 - 19119
* Data Area: 19120 - 39086081
** Cluster Area: 19120 - 39086063
fsstat: getFAT: return cluster too large

Thanks in advance

Jimmy

Re: [sleuthkit-users] File system detection issue with fsstat

[Brian C. <ca...@sl...>]

On Jun 6, 2005, at 10:58 AM, Jaime Chang wrote:

> Hi all,
>
> I run the fsstat command against an ext3 hard drive partition and I 
> got the following error:
>
>   fsstat: Cannot determine if EXT2/3 or FAT
>
> I am wondering if any of you guys have seen this before. Is this an 
> isolated case?... What are the probabilities that fsstat can not 
> detect the supported file systems?

This occurs when you have both a valid FAT boot sector (in sector 0) 
and a valid EXT2/3 superblock (in sectors 2 & 3).  Instead of assuming 
which you want to use, the tools will force you to specify.

This was covered in the last Informer:

http://www.sleuthkit.org/informer/sleuthkit-informer-20.html#autodetect

This can also occur with NTFS and Ext2/3 or UFS.  There are some test 
images on dftt.sf.net.

brian