[sleuthkit-developers] [ sleuthkit-Bugs-3088447 ] NTFS error about adding attribute sequence

[SourceForge.net <no...@so...>]

Bugs item #3088447, was opened at 2010-10-15 19:31
Message generated for change (Comment added) made by carrier
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=3088447&group_id=55685

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: File System Tools
Group: None
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Brian Carrier (carrier)
Assigned to: Brian Carrier (carrier)
Summary: NTFS error about adding attribute sequence

Initial Comment:
Adam Dershowitz reported:

General file system error (fs_attr_add_run:  error adding additional run (9): No filler entry for 0. Final 176) ( - proc_attrseq: put run- proc_attrlist)


----------------------------------------------------------------------

>Comment By: Brian Carrier (carrier)
Date: 2010-10-19 22:49

Message:
The base MFT entry didn't have any details about the IDX_ALLOC entries. 
Requested the ATTRLIST block for more details to see if the id is in there.
 The verbose log shows that all entries in ATTRLIST have an ID of 0. 

----------------------------------------------------------------------

Comment By: Brian Carrier (carrier)
Date: 2010-10-18 23:01

Message:
Issue seems to be because the $Secure file is VERY fragmented and has lots
of attrlists.  There are two NTFS_ATYPE_IDXALLOC attributes and they both
have an ID of 0 in the attrlist entries.  So, we get a collision when the
second one is added to the runs of the first one (because they have the
same type and id).  Sent a request to get MFT entry 9 to see if there is ID
info that we are dropping....

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=3088447&group_id=55685