[sleuthkit-developers] [ sleuthkit-Bugs-3031168 ] Problem with Ext3 recovered files and directories

[SourceForge.net <no...@so...>]

Bugs item #3031168, was opened at 2010-07-18 13:57
Message generated for change (Tracker Item Submitted) made by negin99
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=3031168&group_id=55685

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: File System Tools
Group: None
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Negin Ahmadian (negin99)
Assigned to: Nobody/Anonymous (nobody)
Summary:  Problem with Ext3 recovered files and directories

Initial Comment:
Hi!
I tried TSK with a test image of 4.9MB Ext3 file system. This image has five deleted files and two directories (see attached excel file for files' description). The files rang from single block files to multiple blocks. No data structures were also modified. They were created in Fedora 8.0, deleted in Fedora 8.0 and imaged in Fedora 8.0.
After deletion, size of all the deleted files becomes 0 and they will not be accessible. (CR01-1 picture shows what happens, there is no link available for dir1!)
I tried FAT images and it seems that they work fine. All of the deleted files could be recovered after deletion.


----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=3031168&group_id=55685