NTFS stores sequence numbers to identify when MFT entries have been reallocated. They are currently ignored by TSK. Could use them to mark unallocated names that point to differently unallocated MFT entries (with realloc instead of unalloc).
Log in to post a comment.