Menu

#20 Use NTFS sequence numbers

open
nobody
5
2008-11-30
2008-11-30
No

NTFS stores sequence numbers to identify when MFT entries have been reallocated. They are currently ignored by TSK. Could use them to mark unallocated names that point to differently unallocated MFT entries (with realloc instead of unalloc).

Discussion


Log in to post a comment.