Talk:FS Analysis
From SleuthKitWiki
Under the "Manual Deleted File Recovery" section, the output of fls in the example shows that the inode of the parent directory is 30789. But in the output from fsstat, the inode range of Group 1 and Group 2 are:
Group: 1:
Inode Range: 15393 - 30784
Group: 2:
Inode Range: 30785 - 46176
The example concludes that the inode (30789) is in the range of Group 1. Is there a typo here? Shouldn't it be Group 2?
