# What am I doing wrong?! **URL:** \ **Category:** The Sleuth Kit Help\ **Created:** [November 6, 2019, 12:51pm UTC](https://sleuthkit.discourse.group/t/what-am-i-doing-wrong/351 "2019-11-06T12:51:14Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Curtmagnus](https://avatars.discourse-cdn.com/v4/letter/c/a698b9/32.png) [@Curtmagnus](https://sleuthkit.discourse.group/u/Curtmagnus)\ **Post date:** [November 6, 2019, 12:51pm UTC](https://sleuthkit.discourse.group/t/what-am-i-doing-wrong/351/1 "2019-11-06T12:51:14Z")
I’m trying to parse out a hive file from a mounted forensic container. I’m using the line icat -o 2048 ./ewf1 “inode numbre” \> SYSTEM. The answer I get is “bash: SYSTEM: Function not implemented” I have done this before and it has worked. What am I doing wrong //Magnus ---
**Author:** ![atdt0](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/atdt0/32/202_2.png) [@atdt0](https://sleuthkit.discourse.group/u/atdt0)\ **Post date:** [November 7, 2019, 1:22pm UTC](https://sleuthkit.discourse.group/t/what-am-i-doing-wrong/351/2 "2019-11-07T13:22:47Z")
What kind of filesystem are you trying to redirect that output to? I’m making an assumption here but am wondering if it’s a FUSE volume and you’ve run into a bug. Can you try “\> SYSTEM” to the local hard drive or a exFAT/ext[234] filesystem? ---
**Author:** ![bgrundy](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/bgrundy/32/22_2.png) [@bgrundy](https://sleuthkit.discourse.group/u/bgrundy)\ **Post date:** [November 7, 2019, 1:50pm UTC](https://sleuthkit.discourse.group/t/what-am-i-doing-wrong/351/3 "2019-11-07T13:50:05Z")
The issue is that you are executing the command in the fuse mount directory (./ewf1 shows you are in the directory you used ewfmount on). Either call icat on ewf1 from the parent directory, or write your redirected output in the parent directory (or some other writable directory). rerun the command like this and you will find the file “SYSTEM” one directory level up (assuming that directory is writable to your user): `icat -o 2048 ./ewf1 > ../SYSTEM` ---
**Author:** ![Curtmagnus](https://avatars.discourse-cdn.com/v4/letter/c/a698b9/32.png) [@Curtmagnus](https://sleuthkit.discourse.group/u/Curtmagnus)\ **Post date:** [November 15, 2019, 10:35am UTC](https://sleuthkit.discourse.group/t/what-am-i-doing-wrong/351/4 "2019-11-15T10:35:44Z")
Thank you! Now I got it working.