Re: [sleuthkit-users] istat & ntfs

[Nathan C. <ns...@qs...>]

> Hi there, 
> 
> I have noticed a minor quirk using istat, that only effects small 
> files on ntfs volumes, as far as I am aware:
> 
> When istating an inode of a small file (under one block not sure if this is 
> disk sectors or fs blocks) no blocks are displayed in the output. I am using 
> v1.65. 

If a file is small enough that all of its attributes can fit within the MFT 
record for the file, it is stored entirely within the MFT. i.e. No allocated 
nodes.

If you notice the data attribute in the first file is marked as "Resident" in 
the MFT.

Type: $DATA (128-4)   Name: $Data   Resident   size: 192


Where as in the second it is "Non-Resident" in the MFT;

Type: $DATA (128-4)   Name: $Data   Non-Resident   size: 214416


regards,

Nathan.