[sleuthkit-developers] [ sleuthkit-Feature Requests-3051626 ] Search for NTFS Orphan Files from previous file system.

[SourceForge.net <no...@so...>]

Feature Requests item #3051626, was opened at 2010-08-23 10:58
Message generated for change (Tracker Item Submitted) made by carrier
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477892&aid=3051626&group_id=55685

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: File System
Group: None
Status: Open
Priority: 5
Private: No
Submitted By: Brian Carrier (carrier)
Assigned to: Nobody/Anonymous (nobody)
Summary: Search for NTFS Orphan Files from previous file system.

Initial Comment:
The orphan files in NTFS currently are only based on an existing MFT.  We could also scan the unallocated clusters in the file system for traces of previous MFT entries from a format operation. 

Challenges:
- How to number them?

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477892&aid=3051626&group_id=55685