[sleuthkit-developers] [ sleuthkit-Feature Requests-2424611 ] Ability to output MFT entry slack space

[SourceForge.net <no...@so...>]

Feature Requests item #2424611, was opened at 2008-12-13 18:04
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477892&aid=2424611&group_id=55685

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: File System
Group: None
Status: Open
Priority: 5
Private: No
Submitted By: Brian Carrier (carrier)
Assigned to: Nobody/Anonymous (nobody)
Summary: Ability to output MFT entry slack space

Initial Comment:
MFT entries are a fixed size and there could be unused space at the end that contains relevant data. Provide a way to access it.  This could use a special attribute so that 'icat' can be used to output it. 

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477892&aid=2424611&group_id=55685