|
From: SourceForge.net <no...@so...> - 2005-02-11 15:29:10
|
Read and respond to this message at: https://sourceforge.net/forum/message.php?msg_id=2990989 By: nobody Hi, I ran follow command: ntfsinfo -d "/dev/sdc1" -F "WINDOWS/PCHEALTH/ErrorRep/UserDumps/IEXPLORE.EXE.20041203-141448-00.hdmp" -v -f, and it gave me negative LCN for this file! Using locale 'en_US.UTF-8'. The device /dev/sdc1, is mounted. Forced to continue. Dumping Inode #10281 Update Sequence Array Count: 3 $LogFile seqNum for this Inode: 0x405f21d Number of times reused: 1 Number of hard links: 2 MFT record Flags: Size - Used: 728 bytes Size - Allocated: 1024 bytes Next Attribute Instance Num 5 Dumping attribute $STANDARD_INFORMATION (0x10) File Creation Time: Fri Dec 3 09:14:48 2004 File Altered Time: Fri Dec 3 09:14:53 2004 MFT Changed Time: Fri Dec 3 09:14:53 2004 Last Accessed Time: Fri Dec 3 09:14:53 2004 Max Number of Versions: 0 Version Number: 0 Class ID: 0 User ID: 0 Security ID: 392 Dumping attribute $FILE_NAME (0x30) File Name: 'IEXPLO~1.HDM' File Name Length: 12 Allocated File Size: 0 Real File Size: 0 File Creation Time: Fri Dec 3 09:14:48 2004 File Altered Time: Fri Dec 3 09:14:48 2004 MFT Changed Time: Fri Dec 3 09:14:48 2004 Last Accessed Time: Fri Dec 3 09:14:48 2004 Dumping attribute $FILE_NAME (0x30) File Name: 'IEXPLORE.EXE.20041203-141448-00.hdmp' File Name Length: 36 Allocated File Size: 0 Real File Size: 0 File Creation Time: Fri Dec 3 09:14:48 2004 File Altered Time: Fri Dec 3 09:14:48 2004 MFT Changed Time: Fri Dec 3 09:14:48 2004 Last Accessed Time: Fri Dec 3 09:14:48 2004 Dumping attribute $DATA (0x80) related info Stream name: unnamed Flags: 0x0001 Is resident? No Data size: 2214733 Allocated size: 2228224 Initialized size: 2214733 Compression unit: 4 Compressed size: 716800 Runlist: VCN LCN Length 0 291194 5 5 -1 11 16 291187 4 20 -1 12 32 39540 6 38 -1 10 48 137199 7 55 -1 9 64 137408 7 71 -1 9 80 137440 7 87 -1 9 96 138304 6 102 -1 10 112 406094 2 114 -1 14 128 139567 5 133 -1 11 144 406112 3 147 -1 29 176 406115 1 177 -1 15 192 140650 7 199 -1 9 208 142059 6 214 -1 10 224 406148 7 231 -1 9 240 368667 9 249 -1 7 256 368676 7 263 -1 9 272 142812 7 279 -1 9 288 142906 7 295 -1 9 304 143090 7 311 -1 9 320 143146 7 327 -1 9 336 146676 6 342 -1 10 352 147493 5 357 -1 11 368 149202 4 372 -1 12 384 150260 4 388 -1 12 400 150727 4 404 -1 12 416 150957 5 421 -1 11 432 157278 6 438 -1 10 448 22077 10 458 -1 6 464 158057 4 468 -1 12 480 158087 4 484 -1 12 496 158151 4 500 -1 12 512 291199 1 513 -1 15 528 139572 1 529 -1 15 End of inode reached ______________________________________________________________________ You are receiving this email because you elected to monitor this forum. To stop monitoring this forum, login to SourceForge.net and visit: https://sourceforge.net/forum/unmonitor.php?forum_id=44085 |
