Re: [sleuthkit-users] $I30 file
Brought to you by:
carrier
Menu
▾
▴
Re: [sleuthkit-users] $I30 file
|
From: Wes A. \(N5WA\) <wes...@be...> - 2010-09-09 22:28:26
|
Sorry for the omission. It is in NTFS (WinXP machine). I know the $I30
designation pops up when CHKDSK runs into an indexing problem for a file,
but I think the file might actually be associated with some kind of indexing
of words.
------------------ Wes Attaway (N5WA) ------------------
1138 Waters Edge Circle - Shreveport, LA 71106
318-797-4972 (office) - 318-393-3289 (cell)
Computer Consulting and Forensics
-------------- EnCase Certified Examiner ---------------
_____
From: Karl Bernard [mailto:kar...@gm...]
Sent: Thursday, September 09, 2010 5:19 PM
To: Wes Attaway (N5WA)
Cc: sle...@li...
Subject: Re: [sleuthkit-users] $I30 file
What file system is it in? Probably a meta-data file, like an inode or MFT
file. You won't necessarily find the file name in the index, but will more
likely see the class/type of file.
Karl Bernard
On Thu, Sep 9, 2010 at 5:10 PM, Wes Attaway (N5WA)
<wes...@be...> wrote:
I have a situation where a particular file named $I30 is of interest. It
appears to be some sort of index file but I can't find much info about it.
Even Brian's book, File System Forensic Analysis, doesn't list it in the
index.
Can anyone offer some information about this file (or type of file)?
------------------ Wes Attaway (N5WA) ------------------
1138 Waters Edge Circle - Shreveport, LA 71106
318-797-4972 (office) - 318-393-3289 (cell)
Computer Consulting and Forensics
-------------- EnCase Certified Examiner ---------------
----------------------------------------------------------------------------
--
Automate Storage Tiering Simply
Optimize IT performance and efficiency through flexible, powerful,
automated storage tiering capabilities. View this brief to learn how
you can reduce costs and improve performance.
http://p.sf.net/sfu/dell-sfdev2dev
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org
|
