[sleuthkit-developers] [ sleuthkit-Bugs-2389901 ] Deleted NTFS files should have "unknown" type in file name

[SourceForge.net <no...@so...>]

Bugs item #2389901, was opened at 2008-12-04 13:02
Message generated for change (Comment added) made by carrier
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2389901&group_id=55685

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: File System Tools
Group: None
>Status: Closed
>Resolution: Fixed
Priority: 5
Private: No
Submitted By: Brian Carrier (carrier)
Assigned to: Brian Carrier (carrier)
Summary: Deleted NTFS files should have "unknown" type in file name

Initial Comment:
The deleted NTFS files that are found by searching for entries for a given parent directory should have an "unknown" for the file type as identified in the file name structure (because the file name structure was not analyzed).  This is the behavior that 'ifind -p' currently uses and 'fls' should as well for consistency.

For example:

# fls -Frd -o 59 ntfs_pract.dd
...
r/r * 112-128-4:	My Documents/My Pictures/bandit-streetortrack2005056.jpg

# ifind -p 110 -o 59 ntfs_pract.dd
-/r * 112-128-4:	bandit-streetortrack2005056.jpg

Reported by Barry Grundy.



----------------------------------------------------------------------

>Comment By: Brian Carrier (carrier)
Date: 2008-12-29 20:57

Message:
Fixed for both orphan files and NTFS files that are found via parent
directory.  Checked into trunk and branches/3.0. 

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2389901&group_id=55685