strange non resident data runs

Tool requests, development, and troubleshooting topics related to TSK.

Moderator: carrier

Re: strange non resident data runs

Postby Yeos » Sat Sep 12, 2015 7:44 am

In order to understand, here is the -verbose result provided by stat

ntfs_proc_attrseq: Non-Resident Attribute Type: 128 Id: 4 IdNew: 4 Name: Start VCN: 0
ntfs_make_data_run: Len idx: 0 cur: 184 (b8) tot: 184 (b8)
ntfs_make_data_run: Len idx: 1 cur: 2 (2) tot: 696 (2b8)
ntfs_make_data_run: Off idx: 0 cur: 42 (2a) tot: 42 (2a)
ntfs_make_data_run: Off idx: 1 cur: 161 (a1) tot: 41258 (a12a)
ntfs_make_data_run: Off idx: 2 cur: 0 (0) tot: 41258 (a12a)
ntfs_make_data_run: Signed addr_offset: 41258 Previous address: 0
ntfs_make_data_run: Len idx: 0 cur: 189 (bd) tot: 189 (bd)
ntfs_make_data_run: Len idx: 1 cur: 102 (66) tot: 26301 (66bd)
ntfs_make_data_run: Off idx: 0 cur: 251 (fb) tot: 251 (fb)
ntfs_make_data_run: Off idx: 1 cur: 139 (8b) tot: 35835 (8bfb)
ntfs_make_data_run: Signed addr_offset: -29701 Previous address: 41258
ntfs_make_data_run: Len idx: 0 cur: 133 (85) tot: 133 (85)
ntfs_make_data_run: Len idx: 1 cur: 14 (e) tot: 3717 (e85)
ntfs_make_data_run: Off idx: 0 cur: 91 (5b) tot: 91 (5b)
ntfs_make_data_run: Off idx: 1 cur: 180 (b4) tot: 46171 (b45b)
ntfs_make_data_run: Off idx: 2 cur: 0 (0) tot: 46171 (b45b)
ntfs_make_data_run: Signed addr_offset: 46171 Previous address: 11557
Yeos
 
Posts: 1
Joined: Thu Sep 03, 2015 9:30 am

Return to The Sleuth Kit (TSK)

Who is online

Users browsing this forum: No registered users and 1 guest

cron