[sleuthkit-developers] [ sleuthkit-Bugs-2955899 ] NTFS META_USED flag not always correct

[SourceForge.net <no...@so...>]

Bugs item #2955899, was opened at 2010-02-20 20:54
Message generated for change (Comment added) made by carrier
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2955899&group_id=55685

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: File System Tools
Group: None
>Status: Closed
>Resolution: Fixed
Priority: 5
Private: No
Submitted By: Brian Carrier (carrier)
Assigned to: Nobody/Anonymous (nobody)
Summary: NTFS META_USED flag not always correct

Initial Comment:
The TSK_FS_META_FLAG_USED flag is not always correct when doing a meta_walk with NTFS because the attributes may have been used from a previous file and marked as not used.  The current code just checks for the existence, not the flags.  This effects orphan file finding. 

----------------------------------------------------------------------

>Comment By: Brian Carrier (carrier)
Date: 2010-02-20 21:10

Message:
Sending        branches/sleuthkit-3.1/NEWS.txt
Sending        branches/sleuthkit-3.1/tsk3/fs/ntfs.c
Sending        trunk/NEWS.txt
Sending        trunk/tsk3/fs/ntfs.c
Transmitting file data ....
Committed revision 177.


----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2955899&group_id=55685