[sleuthkit-users] fsstat: Incorrect update sequence value in MFT entry

[Bergander Hans-P. (D. * <Han...@de...>]

I am trying my first steps with TSK - unfortunately I rather quickly =
faced a problem. Looking up the manuals and the web didn't give me an =
answer - hope me question is not too silly.

I have a dd image of /dev/hda1 with ntfs on it. md5's are ok.

Running 'fsstat -v -f ntfs hda1.dd' fails, however, mounting the =
dd-image as ntfs using a loop device works fine.

Here is the output of fsstat:
    ntfs_mft_lookup: Processing MFT 0
    fs_read_random: read offs 2595328 len 1024 (mft read)
    fsstat: Incorrect update sequence value in MFT entry
    Update Value: 0x0 Actual Value: 0x3db Replacement Value: 0x0
    This is typically because of a corrupted entry

I am using TSK ver 1.72 on Debian sarge.

What can I do? Any help would be appriciated.

Thanks
Peter B.