[sleuthkit-users] NTFS compressed files

[Brian C. <ca...@sl...>]

I have gotten several e-mails recently about NTFS compressed files and 
wanted to make everyone aware of it.

NTFS supports file system-level compression.  Version 1.71 of TSK 
started to recognize compressed files, but TSK does not yet uncompress 
them.  Therefore, instead of having 'icat' output compressed junk I 
have made it generate an error to the effect of "TSK does not support 
NTFS compressed files".

So, if you see that message than that is what happened.  You can try 
Linux loopback or other tools to see if they can uncompress the file.  
The first block of a compressed file typically has some ASCII or 
Unicode strings that you can read, so you can try and view that for a 
few basic clues.

brian