TskAuto Linux Swap partition error

Tool requests, development, and troubleshooting topics related to TSK.

Moderator: carrier

TskAuto Linux Swap partition error

Postby jnaegele » Fri Aug 04, 2017 5:40 pm

When using TskAuto's findFilesInImg on a disk containing a Linux Swap partition, it registers the error "Cannot determine file system type".

I believe this is because TskAuto uses TSK_FS_TYPE_DETECT when calling tsk_fs_open_img, and tsk_fs_open_img doesn't try swapfs_open during auto-detection.

Is this expected behavior? I don't expect TskAuto to process files on the Swap partition, but i don't think it should be an error. In other words, once TskAuto finishes, its error list contains an error record because it couldn't detect the file system on the Swap partition, but I'm not sure this should be an error.
jnaegele
 
Posts: 2
Joined: Fri Jun 30, 2017 5:43 pm

Return to The Sleuth Kit (TSK)

Who is online

Users browsing this forum: No registered users and 0 guests

cron