[sleuthkit-developers] [ sleuthkit-Bugs-2975245 ] Misleading conclusion about realloc data

[SourceForge.net <no...@so...>]

Bugs item #2975245, was opened at 2010-03-23 09:12
Message generated for change (Settings changed) made by carrier
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2975245&group_id=55685

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: sorter
Group: None
>Status: Closed
>Resolution: Fixed
Priority: 5
Private: No
Submitted By: Brian Carrier (carrier)
Assigned to: Brian Carrier (carrier)
Summary: Misleading conclusion about realloc data

Initial Comment:
Andrew Hoog reported an issue that led to some confusion.  He has an NTFS image with a deleted exe name that now points to an allocated MFT entry (with a JPG).  It was reported as an extension mismatch.  sorter should ignore realloc entries since the content will be found from another allocated name. 


----------------------------------------------------------------------

>Comment By: Brian Carrier (carrier)
Date: 2010-03-23 19:59

Message:
Sending        branches/sleuthkit-3.1/NEWS.txt
Sending        branches/sleuthkit-3.1/tools/sorter/sorter.base
Sending        trunk/NEWS.txt
Sending        trunk/tools/sorter/sorter.base
Transmitting file data ....
Committed revision 182.


----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2975245&group_id=55685