fls error - General file system error (fs_attr_add_run

Tool requests, development, and troubleshooting topics related to TSK.

Moderator: carrier

fls error - General file system error (fs_attr_add_run

Postby musaleem » Wed Aug 03, 2016 7:30 am

i am getting an error on executing fls -r -m C: XXXXXX.dd -o 718848

General file system error (fs_attr_add_run: error adding additional run (244519): No filler entry for 0. Final: 1) ( - proc_attrseq: put run - proc_attrlist)

MMLS Output is shared below:

DOS Partition Table
Offset Sector: 0
Units are in 512-byte sectors

Slot Start End Length Description
000: Meta 0000000000 0000000000 0000000001 Primary Table (#0)
001: ------- 0000000000 0000002047 0000002048 Unallocated
002: 000:000 0000002048 0000718847 0000716800 NTFS / exFAT (0x07)
003: 000:001 0000718848 0440399871 0439681024 NTFS / exFAT (0x07)
004: ------- 0440399872 0440401919 0000002048 Unallocated

fsstat output is shared below

# fsstat -i raw -o 718848 RYD1-SAC-01-disk1.dd
FILE SYSTEM INFORMATION
--------------------------------------------
File System Type: NTFS
Volume Serial Number: D848B2BF48B29C26
OEM Name: NTFS
Version: Windows XP

METADATA INFORMATION
--------------------------------------------
First Cluster of MFT: 786432
First Cluster of MFT Mirror: 2
Size of MFT Entries: 1024 bytes
Size of Index Records: 4096 bytes
Range: 0 - 268288
Root Directory: 5

CONTENT INFORMATION
--------------------------------------------
Sector Size: 512
Cluster Size: 4096
Total Cluster Range: 0 - 54960126
Total Sector Range: 0 - 439681022

$AttrDef Attribute Values:
$STANDARD_INFORMATION (16) Size: 48-72 Flags: Resident
$ATTRIBUTE_LIST (32) Size: No Limit Flags: Non-resident
$FILE_NAME (48) Size: 68-578 Flags: Resident,Index
$OBJECT_ID (64) Size: 0-256 Flags: Resident
$SECURITY_DESCRIPTOR (80) Size: No Limit Flags: Non-resident
$VOLUME_NAME (96) Size: 2-256 Flags: Resident
$VOLUME_INFORMATION (112) Size: 12-12 Flags: Resident
$DATA (128) Size: No Limit Flags:
$INDEX_ROOT (144) Size: No Limit Flags: Resident
$INDEX_ALLOCATION (160) Size: No Limit Flags: Non-resident
$BITMAP (176) Size: No Limit Flags: Non-resident
$REPARSE_POINT (192) Size: 0-16384 Flags: Non-resident
$EA_INFORMATION (208) Size: 8-8 Flags: Resident
$EA (224) Size: 0-65536 Flags:
$LOGGED_UTILITY_STREAM (256) Size: 0-65536 Flags: Non-resident
musaleem
 
Posts: 1
Joined: Wed Aug 03, 2016 7:13 am

Return to The Sleuth Kit (TSK)

Who is online

Users browsing this forum: No registered users and 1 guest