[sleuthkit-users] ISTAT output question

[Jaime C. <jc...@id...>]

Hello everybody,

In the following istat output,

Directory Entry: 24006
Not Allocated
File Attributes: File, Archive
Size: 10425
Num of links: 0
Name: _UTFOXED.PNG

Directory Entry Times:
Written:        Sun Feb 27 14:39:58 2005
Accessed:       Sun Feb 27 00:00:00 2005
Created:        Sun Feb 27 14:39:58 2005

Sectors:
1545 1546 1547 1548

Recovery:
1545 1546 1547 1548 1549 1550 1551 1552
1553 1554 1555 1556 1557 1558 1559 1560
1561 1562 1563 1564 1565 1566 1567 1568

Does anyone know what might be the difference, if any, between the 
sectors in the "Sectors:" section and the sectors in the "Recovery:" 
section. In most of the deleted files I have been trying, the sectors 
from the "Sectors:" section is always included in the "Recovery:" 
section. Is there a case where this might not be true?

Thanks in advance

Jimmy.