[prev in list] [next in list] [prev in thread] [next in thread] 

List:       sleuthkit-users
Subject:    Re: [sleuthkit-users] bug in mmls 3.01
From:       Brian Carrier <carrier () sleuthkit ! org>
Date:       2009-08-19 14:50:45
Message-ID: 7D93573B-A2FF-419E-9914-768977FD4137 () sleuthkit ! org
[Download RAW message or body]

Thanks.  I fixed a bug in the output.  I changed the notion of  
Unallocated in 3.0 so that it includes all areas of the disk that are  
not explicitly mentioned in a partition table. So, partition tables  
are now grouped into the "Unallocated" space (i.e. the difference in  
line 07).

The reason for the missing Unallocated is because I was not marking  
the Extended Partition in 09 as Meta and therefore mmls thought that  
the space between the partitions was allocated by that partition  
(because of the design of DOS partitions).

The fix is checked into the trunk.

brian

On Aug 8, 2009, at 5:28 PM, . . wrote:

> On my disk. I have 3 primary and one extended partition.  In the
> extended partition, I have multiple logical volumes.  When looking at
> the space between logical partitions, mmls version 2.52 shows 1 sector
> for the partition table on one line and 62 sectors unallocated on the
> next line.  This is normal.
>
> However, version 3.01 shows one line (meta) for the partition table,
> but no line for the unallocated area.  Offsets look strange too (lines
> 10,11).
>
>
> Ver 2.52:
> 05:  00:03   0156312450   0312581807   0156269358   Win95 Extended  
> (0x0F)
> 06:  -----   0156312450   0156312450   0000000001   Extended Table  
> (#1)
> 07:  -----   0156312451   0156312512   0000000062   Unallocated
> 08:  01:00   0156312513   0208844999   0052532487   Win95 FAT32 (0x0C)
> 09:  01:01   0208845000   0271498499   0062653500   DOS Extended  
> (0x05)
> 10:  -----   0208845000   0208845000   0000000001   Extended Table  
> (#2)
> 11:  -----   0208845001   0208845062   0000000062   Unallocated
>
>
> ver 3.01
> 05:  Meta    0156312450   0312581807   0156269358   Win95 Extended  
> (0x0F)
> 06:  Meta    0156312450   0156312450   0000000001   Extended Table  
> (#1)
> 07:  -----   0156312450   0156312512   0000000063   Unallocated
> 08:  01:00   0156312513   0208844999   0052532487   Win95 FAT32 (0x0C)
> 09:  01:01   0208845000   0271498499   0062653500   DOS Extended  
> (0x05)
> 10:  Meta    0208845000   0208845000   0000000001   Extended Table  
> (#2)
> 11:  02:00   0208845063   0271498499   0062653437   Linux (0x83)
>
> ------------------------------------------------------------------------------
> Let Crystal Reports handle the reporting - Free Crystal Reports 2008  
> 30-Day
> trial. Simplify your report design, integration and deployment - and  
> focus on
> what you do best, core application coding. Discover what's new with
> Crystal Reports now.  http://p.sf.net/sfu/bobj-july
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org


------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day 
trial. Simplify your report design, integration and deployment - and focus on 
what you do best, core application coding. Discover what's new with 
Crystal Reports now.  http://p.sf.net/sfu/bobj-july
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org
[prev in list] [next in list] [prev in thread] [next in thread]