Talk:FS Analysis

From SleuthKitWiki
Jump to: navigation, search

Under the "Manual Deleted File Recovery" section, the output of fls in the example shows that the inode of the parent directory is 30789. But in the output from fsstat, the inode range of Group 1 and Group 2 are:

Group: 1:

     Inode Range: 15393 - 30784

Group: 2:

     Inode Range: 30785 - 46176

The example concludes that the inode (30789) is in the range of Group 1. Is there a typo here? Shouldn't it be Group 2?