Re: [sleuthkit-users] fsstat: Incorrect update sequence value in MFT entry

[Brian C. <ca...@sl...>]

Can you send me the data from running the following:

dd if=IMG.dd bs=512 skip=5069 count=2 of=mft.dat

This is the MFT that has the bad update values.

brian

On Oct 4, 2004, at 3:04 AM, Bergander Hans-Peter (DSB) * wrote:

> I am trying my first steps with TSK - unfortunately I rather quickly 
> faced a problem. Looking up the manuals and the web didn't give me an 
> answer - hope me question is not too silly.
>
> I have a dd image of /dev/hda1 with ntfs on it. md5's are ok.
>
> Running 'fsstat -v -f ntfs hda1.dd' fails, however, mounting the 
> dd-image as ntfs using a loop device works fine.
>
> Here is the output of fsstat:
>     ntfs_mft_lookup: Processing MFT 0
>     fs_read_random: read offs 2595328 len 1024 (mft read)
>     fsstat: Incorrect update sequence value in MFT entry
>     Update Value: 0x0 Actual Value: 0x3db Replacement Value: 0x0
>     This is typically because of a corrupted entry
>
> I am using TSK ver 1.72 on Debian sarge.
>
> What can I do? Any help would be appriciated.