Menu

#64 handle multiple $FILE_NAME attr

open
nobody
5
2011-02-11
2011-02-11
prosaic
No

In NTFS, an inode can have multiple $FILE_NAME attributes. This usually occurs with just long and short file names if the system needs/wants to keep an 8.3 compatible file name, but can also happen if the system creates a hard link giving that inode a new name in a new directory. Also, as times in $FILE_NAME attributes are only updated if that attribute was updated, it is possible for the times in each $FILE_NAME to be different, giving further clues as to actions taken on that file.

It would be very handy if istat parsed and displayed all of the $FILE_NAME attributes instead of just the first one, so that we could see the name, parent inode, and times associated with the others as well.

Discussion


Log in to post a comment.