Re: [sleuthkit-users] NTFS, files with no permissions

[Brian C. <ca...@sl...>]

Can you run 'ls -i' on these files to find the "inode" number and then 
run 'istat' on them?  You can also run 'istat' by using the Metadata 
mode in Autopsy.  Is this the same file system that you previously 
noted that it had some consistency issues? Did you ever run 'fsck' or 
similar to fix the problems?

brian



On Jun 24, 2005, at 8:12 AM, fu...@gm... wrote:

> Hi
>
> Once more, I'm looking at a NTFS-Disk. When I mount ro the disk, I can 
> see
> in a directory the File archive2005.pst with the following permission:
>
> -r--------  1           0 2005-06-06 08:30 archive2004.pst
>
> So file size is 0, the rest seems okay. But when I go to the directory 
> in
> Autopsy, the file does not appear. What did happen here? Any 
> information I
> can provide you? I use Autopsy 2.05 and sleuthkit 2.01 on a Debian 
> Sarge.
>
> The other issue is: I have a file which looks the following when I do 
> ls -l
> in the mounted disk:
>
> ?---------  1       0 2002-04-21 11:46 54I70048.jpg
>
> When I look into Autops, the file shows not up. If I try to copy the 
> file
> from the mounted filesystem to somewhere, cp bothers me with "argument 
> is
> illegal". So there is something wrong with this file but I'm wondering 
> why
> it's not shown in Autopsy?