Menu

#215 FAT LFN entries are not parsed properly for the long names

1.65
open
None
5
2014-04-22
2014-04-22
No

Sleuth kit 4.1.2 Windows 7 x64
When there's a really long name (> 248 symbol) it's split into 2 LFN entries. Current TSK implementation parses only first LFN entry and the second is thought invalid directory entry, so the file name is cut off to 248 symbols.
Example drive image is attached.

p.s. all tsk tools in this case are showing 8-3 short name for such long-named file.

1 Attachments

Discussion


Log in to post a comment.

Want the latest updates on software, tech news, and AI?
Get latest updates about software, tech news, and AI from SourceForge directly in your inbox once a month.