sleuthkit icon indicating copy to clipboard operation
sleuthkit copied to clipboard

ext3: read blocks indefinitely on files larger than 8GB

Open eyalgolan1337 opened this issue 1 year ago • 1 comments

Overview

On ext3 filesystems libtsk's tsk_fs_file_read() blocks indefinitely for files larger than 8gb.

Steps to reproduce

Tested on tsk v4.12.1 and v4.11.1 and reproduces on both. On any Linux machine with an ext3 filesystem create a large file (8gb+, might reproduce from a smaller size) and call tsk_fs_file_read() on it, the call would block forever.

eyalgolan1337 avatar Aug 06 '24 13:08 eyalgolan1337

Hi. Can you provide instructions for making a test disk image and the exact sequence of commands that you are using?

simsong avatar Oct 04 '24 01:10 simsong