[sleuthkit-developers] [ sleuthkit-Bugs-3088447 ] NTFS error about adding attribute sequence

[SourceForge.net <no...@so...>]

Bugs item #3088447, was opened at 2010-10-15 19:31
Message generated for change (Comment added) made by carrier
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=3088447&group_id=55685

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: File System Tools
Group: None
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Brian Carrier (carrier)
Assigned to: Brian Carrier (carrier)
Summary: NTFS error about adding attribute sequence

Initial Comment:
Adam Dershowitz reported:

General file system error (fs_attr_add_run:  error adding additional run (9): No filler entry for 0. Final 176) ( - proc_attrseq: put run- proc_attrlist)


----------------------------------------------------------------------

>Comment By: Brian Carrier (carrier)
Date: 2010-10-18 23:01

Message:
Issue seems to be because the $Secure file is VERY fragmented and has lots
of attrlists.  There are two NTFS_ATYPE_IDXALLOC attributes and they both
have an ID of 0 in the attrlist entries.  So, we get a collision when the
second one is added to the runs of the first one (because they have the
same type and id).  Sent a request to get MFT entry 9 to see if there is ID
info that we are dropping....

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=3088447&group_id=55685