sleuthkit icon indicating copy to clipboard operation
sleuthkit copied to clipboard

Endianness issue with "Volume ID" of fsstat?

Open mb720 opened this issue 4 years ago • 1 comments

Hi and thanks a lot for The Sleuth Kit!

I created an ext4 file system on a loopback device with mkfs.ext4, this was part of the output:

Filesystem UUID: 467b1317-e3f8-41d2-82b9-2353c00d25b1

When examining the device with fsstat, I get this:

Volume ID: b1250dc05323b982d241f8e317137b46

It seems to me as if the order of the bytes is reversed when comparing the output of fsstat and mkfs.ext4.

Is this expected or some sort of endianness issue?


Here's an image of the device.

mb720 avatar Feb 08 '21 11:02 mb720

Not only the endianess is wrong Filesystem UUID: 9483035e-29d0-4509-8e9c-3662c0cad173 but also fsstat outputs: 73d1cac062369c8e945d0295e038394 This output has a length of 31 chars but should be 32 The reason is that a 0 is missing from the 09 73d1cac062369c8e945d0295e038394 is wrong 73d1cac062369c8e0945d0295e038394 is right

NiclasPohl avatar Mar 25 '24 17:03 NiclasPohl