#175 TSK 3.2.1 and NTFS problems

[msuhanov]

TSK 3.2.1 cannot understand NTFS file systems created using non-standard sector size.

Sample file system image: http://anti-forensics.ru/tsk3/ntfs-undetectable.rar

$ file ntfs-undetectable.dd
ntfs-undetectable.dd: x86 boot sector, code offset 0x52, OEM-ID "NTFS ", Bytes/sector 2048, sectors/cluster 2, reserved sectors 0, Media descriptor 0xf8, dos < 4.0 BootSector (0x80)

$ fls ntfs-undetectable.dd
Cannot determine file system type

$ ntfsls ntfs-undetectable.dd
test.txt

[Anton Kukoba]

I have a patch to fix this problem. See the attachment