sleuthkit-users

[sleuthkit-users] Error in IPOD Image

[Gustavo V. <gu...@gm...>]

C:\IPED 3.9.4\tools\tsk\x64>tsk_loaddb.exe -v "j:\Memo5053-16 Equipe RJ-01\Image
ns\Item03_ItemArrecadacao03.E01"
TskAutoDb::startAddImage: Starting add image process
tsk_img_open: Type: 0   NumImg: 1  Img1: j:\Memo5053-16 Equipe RJ-01\Imagens\Ite
m03_ItemArrecadacao03.E01
ewf_open: found 1 segment files via libewf_glob
dos_load_prim: Table Sector: 0
ewf_image_read: byte offset: 0 len: 65536
dos_load_prim_table: Testing FAT/NTFS conditions
dos_load_prim_table: MSDOS OEM name exists
bsd_load_table: Table Sector: 1
gpt_load_table: Sector: 0
gpt_open: Trying other sector sizes
gpt_open: Trying sector size: 512
gpt_load_table: Sector: 0
gpt_open: Trying sector size: 1024
gpt_load_table: Sector: 0
gpt_open: Trying sector size: 2048
gpt_load_table: Sector: 0
gpt_open: Trying sector size: 4096
gpt_load_table: Sector: 0
gpt_open: Trying sector size: 8192
gpt_load_table: Sector: 0
sun_load_table: Trying sector: 0
sun_load_table: Trying sector: 1
mac_load_table: Sector: 1
mac_load: Missing initial magic value
mac_open: Trying 4096-byte sector size instead of 512-byte
mac_load_table: Sector: 1
mac_load: 0  Starting Sector: 1  Size: 62 Type: Apple_partition_map Status: 0
findFilesInVs: Error opening volume system, trying as a file system
fsopen: Auto detection mode at offset 0
ntfs_open: invalid volume size: 0
fatxxfs_open: Invalid number of sectors per FAT (0)
exfatfs_get_fs_size_params: Invalid sector size base 2 logarithm (4096), not in
range (9 - 12)
fatxxfs_open: Invalid number of sectors per FAT (0)
ext2fs_open: invalid magic
ewf_image_read: byte offset: 65536 len: 65536
ufs_open: Trying 256KB UFS2 location
ewf_image_read: byte offset: 262144 len: 65536
ufs_open: Trying UFS1 location
ufs_open: No UFS magic found
ewf_image_read: byte offset: 156160 len: 65536
ewf_image_read: byte offset: 426496 len: 65536
ewf_image_read: byte offset: 407552 len: 65536
ewf_image_read: byte offset: 561664 len: 65536
ewf_image_read: byte offset: 542720 len: 65536
ewf_image_read: byte offset: 696832 len: 65536
ewf_image_read: byte offset: 677888 len: 65536
ewf_image_read: byte offset: 832000 len: 65536
ewf_image_read: byte offset: 813056 len: 65536
ewf_image_read: byte offset: 967168 len: 65536
ewf_image_read: byte offset: 948224 len: 65536
ewf_image_read: byte offset: 1102336 len: 65536
ewf_image_read: byte offset: 1083392 len: 65536
ewf_image_read: byte offset: 1237504 len: 65536
ewf_image_read: byte offset: 1218560 len: 65536
ewf_image_read: byte offset: 1372672 len: 65536
ewf_image_read: byte offset: 1353728 len: 65536
ewf_image_read: byte offset: 1507840 len: 65536
ewf_image_read: byte offset: 1488896 len: 65536
yaffsfs_open: could not find valid spare area format
See http://wiki.sleuthkit.org/index.php?title=YAFFS2 for help on Yaffs2 configur
ation
ewf_image_read: byte offset: 1024 len: 65536
iso9660_open img_info: 3194832 ftype: 2048 test: 1
iso_load_vol_desc: Bad volume descriptor: Magic number is not CD001
Trying RAW ISO9660 with 16-byte pre-block size
fs_prepost_read: Mapped 32768 to 37648
iso_load_vol_desc: Bad volume descriptor: Magic number is not CD001
Trying RAW ISO9660 with 24-byte pre-block size
fs_prepost_read: Mapped 32768 to 37656
iso_load_vol_desc: Bad volume descriptor: Magic number is not CD001
iso9660_open: Error loading volume descriptor
Error: Cannot determine file system type (Sector offset: 0)
TskAutoDb::commitAddImage: Commiting add image process
Database stored at: j:\Memo5053-16 Equipe RJ-01\Imagens\Item03_ItemArrecadacao03
.E01.db

Re: [sleuthkit-users] Error in IPOD Image

[Joel G. <joe...@gm...>]

Hi gustavo
I think the sector size is not 512 for an iPod
But i can remembrer this info
Any help ?

Le ven. 24 juin 2016 à 18:09, Gustavo Valadares <gu...@gm...> a
écrit :

> Hi,
>
> I've created an E01 file from an iPod device pluged in Windows 7 via USB
> using FKT Imager.
>
> The imagem is OK, I can open it in FTK Imager.
>
> But SleuthKit can't recognize the file system:
>
> "Error: Cannot determine file system type (Sector offset: 0)"
>
> Running tsk_loaddb.exe in this image, with verbose option set, I get the
> output listed in the attached file.
>
> I guess it's a bug.
>
> Any help?
>
> Thanks.
>
> ------------------------------------------------------------------------------
> Attend Shape: An AT&T Tech Expo July 15-16. Meet us at AT&T Park in San
> Francisco, CA to explore cutting-edge tech and listen to tech luminaries
> present their vision of the future. This family event has something for
> everyone, including kids. Get more information and register today.
> http://sdm.link/attshape_______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>