sleuthkit-users

[sleuthkit-users] too many false positives

[<gim...@we...>]

Hi,

does anyone know, why calling

fls -f fat -p -r image.img=20

and

icat -f fat -r zippad.img (both used in script)

brings up so many false positives?

Look here:

$file
...
_FCHEN~1.DOC: data
_U=E1BAK~1.DOC: MPEG ADTS, AAC, v4 Main, 96 kHz
_UFA1E~1.DOC: COM executable for MS-DOS
_DNKTE~1.DOC: ASCII HTML document text
...

What can i do to get better results?

Does anyone know the trick?

regards

Re: [sleuthkit-users] too many false positives

[Brian C. <ca...@sl...>]

They are deleted files and the clusters that they previously used =20
have been reallocated.  fls has no way of knowing if they have been =20
reallocated or not (and actually you don't either because there could =20=

be MPEGs and HTML files with a .doc extension).

brian


On Mar 2, 2006, at 2:31 PM, "" <gim...@we...> <gim...@we...> =20
wrote:

> Hi,
>
> does anyone know, why calling
>
> fls -f fat -p -r image.img
>
> and
>
> icat -f fat -r zippad.img (both used in script)
>
> brings up so many false positives?
>
> Look here:
>
> $file
> ...
> _FCHEN~1.DOC: data
> _U=E1BAK~1.DOC: MPEG ADTS, AAC, v4 Main, 96 kHz
> _UFA1E~1.DOC: COM executable for MS-DOS
> _DNKTE~1.DOC: ASCII HTML document text
> ...
>
> What can i do to get better results?
>
> Does anyone know the trick?
>
> regards
>
>
> -------------------------------------------------------
> This SF.Net email is sponsored by xPML, a groundbreaking scripting =20
> language
> that extends applications into web and mobile media. Attend the =20
> live webcast
> and join the prime developer group breaking into this new coding =20
> territory!
> http://sel.as-us.falkag.net/sel?=20
> cmd_______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

Re: [sleuthkit-users] too many false positives

[<gim...@we...>]

On Fri, 3 Mar 2006 12:15:03 -0500
Brian Carrier <ca...@sl...> wrote:

> They are deleted files and the clusters that they previously used  
> have been reallocated.  fls has no way of knowing if they have been  
> reallocated or not (and actually you don't either because there
> could be MPEGs and HTML files with a .doc extension).


So i used file utility to check this.
Is there any tool or magicfile database which does this check better in
mind of forensic analyzes?
file will check by magic key, but perhaps files do have more
characteristics file doesn't check because it doesn't need to.

regards

Re: SPAM: 99.9: Re: [sleuthkit-users] too many false positives

[Brian C. <ca...@sl...>]

On Mar 6, 2006, at 7:24 AM, "" <gim...@we...> <gim...@we...>  
wrote:

> On Fri, 3 Mar 2006 12:15:03 -0500
> Brian Carrier <ca...@sl...> wrote:
>
>> They are deleted files and the clusters that they previously used
>> have been reallocated.  fls has no way of knowing if they have been
>> reallocated or not (and actually you don't either because there
>> could be MPEGs and HTML files with a .doc extension).
>
>
> So i used file utility to check this.
> Is there any tool or magicfile database which does this check  
> better in
> mind of forensic analyzes?
> file will check by magic key, but perhaps files do have more
> characteristics file doesn't check because it doesn't need to.

The sorter tool will compare the output of 'file' with a database of  
extensions.

brian