[sleuthkit-developers] [ sleuthkit-Bugs-2534449 ] Extra NTFS file names in directory

[SourceForge.net <no...@so...>]

Bugs item #2534449, was opened at 2009-01-24 22:57
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2534449&group_id=55685

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: File System Tools
Group: None
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Brian Carrier (carrier)
Assigned to: Nobody/Anonymous (nobody)
Summary: Extra NTFS file names in directory

Initial Comment:
'fls' will report the unallocated versions of a file name if the MFT address was wiped to 0. 

% fls -o 32 -f ntfs -m c:/ img.bin.E0*| grep Doc
0|c:/Documents and Settings (deleted)|0|d/----------|0|0|0|0|0|0
0|c:/Documents and Settings|3666-144-6|d/drwxrwxrwx|0|0|56|1229403478|1200903286|1200903286|1200915835

This was found because it caused problems with 'ifind -n'.  'ifind' was grabbing the first entry entry, which points to 0 and cannot be recursed into. 

Reported by Andy Bontoft. 

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2534449&group_id=55685