Created
July 11, 2013 12:50
-
-
Save anarchivist/5975167 to your computer and use it in GitHub Desktop.
Verbose/debug output from fiwalk
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| $ fiwalk -dv 2012-M-045/2012-M-045-0040.001 | |
| image_filename: 2012-M-045/2012-M-045-0040.001 | |
| fiwalk_version: 4.1.0 | |
| start_time: Thu Jul 11 08:39:03 2013 | |
| tsk_version: 4.1.0 | |
| calling tsk_img_open(2012-M-045/2012-M-045-0040.001) | |
| tsk_img_open: Type: 0 NumImg: 1 Img1: 2012-M-045/2012-M-045-0040.001 | |
| tsk_img_findFiles: 2012-M-045/2012-M-045-0040.001 found | |
| tsk_img_findFiles: 1 total segments found | |
| raw_open: segment: 0 size: 100663296 max offset: 100663296 path: 2012-M-045/2012-M-045-0040.001 | |
| calling do_dimage() | |
| dos_load_prim: Table Sector: 0 | |
| raw_read: byte offset: 0 len: 65536 | |
| raw_read: found in image 0 relative offset: 0 len: 65536 | |
| raw_read_segment: opening file into slot 0: 2012-M-045/2012-M-045-0040.001 | |
| File is not a DOS partition (invalid primary magic) (Sector: 0)bsd_load_table: Table Sector: 1 | |
| gpt_load_table: Sector: 0 | |
| gpt_open: Trying other sector sizes | |
| gpt_open: Trying sector size: 512 | |
| gpt_load_table: Sector: 0 | |
| gpt_open: Trying sector size: 1024 | |
| gpt_load_table: Sector: 0 | |
| gpt_open: Trying sector size: 2048 | |
| gpt_load_table: Sector: 0 | |
| gpt_open: Trying sector size: 4096 | |
| gpt_load_table: Sector: 0 | |
| gpt_open: Trying sector size: 8192 | |
| gpt_load_table: Sector: 0 | |
| sun_load_table: Trying sector: 0 | |
| sun_load_table: Trying sector: 1 | |
| mac_load_table: Sector: 1 | |
| mac_load: 0 Starting Sector: 1 Size: 10 Type: Apple_partition_map Status: 0 | |
| mac_load: 1 Starting Sector: 11 Size: 400 Type: Apple_Driver43 Status: 0 | |
| mac_load: 2 Starting Sector: 411 Size: 128 Type: Apple_Driver_ATA Status: 0 | |
| mac_load: 3 Starting Sector: 539 Size: 196069 Type: Apple_HFS Status: 0 | |
| Volume system open, examining each | |
| # Retrying with 512 byte sector size. | |
| tsk_img_open: Type: 0 NumImg: 1 Img1: 2012-M-045/2012-M-045-0040.001 | |
| tsk_img_findFiles: 2012-M-045/2012-M-045-0040.001 found | |
| tsk_img_findFiles: 1 total segments found | |
| raw_open: segment: 0 size: 100663296 max offset: 100663296 path: 2012-M-045/2012-M-045-0040.001 | |
| calling do_dimage() | |
| dos_load_prim: Table Sector: 0 | |
| raw_read: byte offset: 0 len: 65536 | |
| raw_read: found in image 0 relative offset: 0 len: 65536 | |
| raw_read_segment: opening file into slot 0: 2012-M-045/2012-M-045-0040.001 | |
| File is not a DOS partition (invalid primary magic) (Sector: 0)bsd_load_table: Table Sector: 1 | |
| gpt_load_table: Sector: 0 | |
| gpt_open: Trying other sector sizes | |
| gpt_open: Trying sector size: 512 | |
| gpt_load_table: Sector: 0 | |
| gpt_open: Trying sector size: 1024 | |
| gpt_load_table: Sector: 0 | |
| gpt_open: Trying sector size: 2048 | |
| gpt_load_table: Sector: 0 | |
| gpt_open: Trying sector size: 4096 | |
| gpt_load_table: Sector: 0 | |
| gpt_open: Trying sector size: 8192 | |
| gpt_load_table: Sector: 0 | |
| sun_load_table: Trying sector: 0 | |
| sun_load_table: Trying sector: 1 | |
| mac_load_table: Sector: 1 | |
| mac_load: 0 Starting Sector: 1 Size: 10 Type: Apple_partition_map Status: 0 | |
| mac_load: 1 Starting Sector: 11 Size: 400 Type: Apple_Driver43 Status: 0 | |
| mac_load: 2 Starting Sector: 411 Size: 128 Type: Apple_Driver_ATA Status: 0 | |
| mac_load: 3 Starting Sector: 539 Size: 196069 Type: Apple_HFS Status: 0 | |
| Volume system open, examining each | |
| # clock: 0 | |
| # =EOF= | |
| $ mmls -v 2012-M-045/2012-M-045-0040.001 | |
| tsk_img_open: Type: 0 NumImg: 1 Img1: 2012-M-045/2012-M-045-0040.001 | |
| tsk_img_findFiles: 2012-M-045/2012-M-045-0040.001 found | |
| tsk_img_findFiles: 1 total segments found | |
| raw_open: segment: 0 size: 100663296 max offset: 100663296 path: 2012-M-045/2 | |
| 012-M-045-0040.001 | |
| dos_load_prim: Table Sector: 0 | |
| raw_read: byte offset: 0 len: 65536 | |
| raw_read: found in image 0 relative offset: 0 len: 65536 | |
| raw_read_segment: opening file into slot 0: 2012-M-045/2012-M-045-0040.001 | |
| File is not a DOS partition (invalid primary magic) (Sector: 0)bsd_load_table: T | |
| able Sector: 1 | |
| gpt_load_table: Sector: 0 | |
| gpt_open: Trying other sector sizes | |
| gpt_open: Trying sector size: 512 | |
| gpt_load_table: Sector: 0 | |
| gpt_open: Trying sector size: 1024 | |
| gpt_load_table: Sector: 0 | |
| gpt_open: Trying sector size: 2048 | |
| gpt_load_table: Sector: 0 | |
| gpt_open: Trying sector size: 4096 | |
| gpt_load_table: Sector: 0 | |
| gpt_open: Trying sector size: 8192 | |
| gpt_load_table: Sector: 0 | |
| sun_load_table: Trying sector: 0 | |
| sun_load_table: Trying sector: 1 | |
| mac_load_table: Sector: 1 | |
| mac_load: 0 Starting Sector: 1 Size: 10 Type: Apple_partition_map Status: 0 | |
| mac_load: 1 Starting Sector: 11 Size: 400 Type: Apple_Driver43 Status: 0 | |
| mac_load: 2 Starting Sector: 411 Size: 128 Type: Apple_Driver_ATA Status: 0 | |
| mac_load: 3 Starting Sector: 539 Size: 196069 Type: Apple_HFS Status: 0 | |
| MAC Partition Map | |
| Offset Sector: 0 | |
| Units are in 512-byte sectors | |
| Slot Start End Length Description | |
| 00: ----- 0000000000 0000000000 0000000001 Unallocated | |
| 01: 00 0000000001 0000000010 0000000010 Apple_partition_map | |
| 02: Meta 0000000001 0000000004 0000000004 Table | |
| 03: 01 0000000011 0000000410 0000000400 Apple_Driver43 | |
| 04: 02 0000000411 0000000538 0000000128 Apple_Driver_ATA | |
| 05: 03 0000000539 0000196607 0000196069 Apple_HFS | |
| $ fls -o 539 2012-M-045/2012-M-045-0040.001 | |
| r/r 3: $ExtentsFile | |
| r/r 4: $CatalogFile | |
| r/r 5: $BadBlockFile | |
| r/r 6: $AllocationFile | |
| r/r 30: .DS_Store | |
| d/d 27: .Trashes | |
| r/r 45: c5 rEGS sites for PS.doc | |
| r/r 37: C5BA rEGS 091208-1.tif | |
| r/r 38: C5BH rEGS 110708-1.tif | |
| r/r 39: C5BM rEGS 091208-1.tif | |
| r/r 40: C5BS rEGS 103108-1.tif | |
| r/r 41: C5EC C5EF rEGS 110308-1.tif | |
| r/r 42: C5FT rEGS 100608-1.tif | |
| r/r 43: C5SA C5ST rEGS 110308-1.tif | |
| r/r 44: C5YP rEGS 100608-1.tif | |
| -/r 18: Desktop DB | |
| -/r 17: Desktop DF | |
| -/r 24: DesktopPrinters DB | |
| -/r 22: Icon^ | |
| -/r 35: Norton FS Data | |
| -/r 34: Norton FS Index | |
| -/r 25: OpenFolderListDF^ | |
| d/d 16: TheVolumeSettingsFolder | |
| r/r 51: UPS_NR1 2.exe | |
| r/r 53: UPS_NR1 3.exe | |
| r/r 55: UPS_NR1 4.exe | |
| r/r 57: UPS_NR1 5.exe | |
| r/r 59: UPS_NR1 6.exe | |
| r/r 61: UPS_NR1 7.exe | |
| r/r 49: UPS_NR1.exe | |
| r/r 47: UPS_NR1.zip | |
| d/d 26: ^^^^HFS+ Private Data |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment