[sleuthkit-developers] [ sleuthkit-Bugs-2367426 ] Fix NTFS VDL Slack bug

[SourceForge.net <no...@so...>]

Bugs item #2367426, was opened at 2008-11-30 17:55
Message generated for change (Settings changed) made by carrier
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2367426&group_id=55685

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: File System Tools
Group: None
>Status: Closed
>Resolution: Fixed
Priority: 5
Private: No
Submitted By: Brian Carrier (carrier)
Assigned to: Brian Carrier (carrier)
Summary: Fix NTFS VDL Slack bug

Initial Comment:
NTFS non-resident streams have a value that stores how much of the stream has been initialized.  This is not currently being processed by TSK.

----------------------------------------------------------------------

>Comment By: Brian Carrier (carrier)
Date: 2009-05-07 22:31

Message:
Fixed rest of issue so that "slack" flags to icat or the read API commands
will still return the uninitialized space. 

Sending        trunk/CHANGES.txt
Sending        trunk/tsk3/fs/fs_attr.c
Transmitting file data ..
Committed revision 93.


----------------------------------------------------------------------

Comment By: Brian Carrier (carrier)
Date: 2009-05-06 23:49

Message:
Completed first step, which is to return 0s after initialized part of file.
Sending        trunk/CHANGES.txt
Sending        trunk/tsk3/fs/fatfs_meta.c
Sending        trunk/tsk3/fs/fs_attr.c
Sending        trunk/tsk3/fs/hfs.c
Sending        trunk/tsk3/fs/iso9660.c
Sending        trunk/tsk3/fs/ntfs.c
Sending        trunk/tsk3/fs/tsk_fs.h
Sending        trunk/tsk3/fs/tsk_fs_i.h
Sending        trunk/tsk3/fs/unix_misc.c
Transmitting file data .........
Committed revision 92.

Still need to part 2, which is to show uninitialized file contents if
slack flag is given. 

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2367426&group_id=55685