![]() ![]() ![]() We've seen cases with mixed MBR/GPT partition tables where the output of mmls is plain wrong (offset and/or sector size), same with edge cases like images created with Norton Ghost. So the mmls slot terminology does not correspond with that of fdisk and gdisk. The value "000:000" relates to the first primary partition, "000:001" to the second primary partition, "001:000" to the first extended partition, etc.įor log2timeline.py just count the number of slots that refer to actual partitions. Note that it overloads the term partition as well. I've changed the formatting so you can see that 002: is not the slot number, but number of the "part info" (not partition) as sleuthkit calls this. ![]()
0 Comments
Leave a Reply. |