Sleuthkit ifind output

General (Technical, Procedural, Software, Hardware etc.)

Last Post by bmaree 16 years ago

1 Posts

1 Users

0 Reactions

782 Views

RSS

bmaree

(@bmaree)

Active Member

Joined: 17 years ago

Posts: 11

Topic starter 06/03/2010 2:58 pm [#5460]

I'm practicing to retrieve a deleted image from an ext2/3 partition. Using sigfind I located the address of the unallocated block. Now when I use ifind to get the inode, instead of an address I get the word Meta Data
root@stl2-desktop/home/stl2# ifind -o 208845 -d 5121 /media/EvidenceLocker/imageofsdd.dd Meta Data root@stl2-desktop/home/stl2#
Thank you for any help.

Quote