[sleuthkit-developers] [ sleuthkit-Bugs-3226705 ] TSK 3.2.1 and NTFS problems

[SourceForge.net <no...@so...>]

Bugs item #3226705, was opened at 2011-03-19 21:04
Message generated for change (Tracker Item Submitted) made by msuhanov
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=3226705&group_id=55685

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: File System Tools
Group: None
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: msuhanov (msuhanov)
Assigned to: Nobody/Anonymous (nobody)
Summary: TSK 3.2.1 and NTFS problems

Initial Comment:
TSK 3.2.1 cannot understand NTFS file systems created using non-standard sector size.

Sample file system image: http://anti-forensics.ru/tsk3/ntfs-undetectable.rar

$ file ntfs-undetectable.dd
ntfs-undetectable.dd: x86 boot sector, code offset 0x52, OEM-ID "NTFS ", Bytes/sector 2048, sectors/cluster 2, reserved sectors 0, Media descriptor 0xf8, dos < 4.0 BootSector (0x80)

$ fls ntfs-undetectable.dd
Cannot determine file system type

$ ntfsls ntfs-undetectable.dd
test.txt

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=3226705&group_id=55685