[sleuthkit-users] autopsy/sleuthkit export problem

[Jeremy A. <jer...@gm...>]

Hi,

I'm using version 2.24 of autopsy and sleuthkit version 4.01 on a Centos
6.4 system.

I am working with a large EWF (E01) set of image parts. I have a
particular file I want to export from an ntfs partitions in the image.
The file is about 3.4 GB.

I used the autopsy interface and exported it based on the ntfs 'inode'.
The export ended up about 1.4 GB. I then used icat to export the file
and got an identical result,

After this I mounted the image parts using libewf and fuse and ntfs-3g
and copied the file for analysis with no problem.

My particular issue is resolved, but to prevent the pain in future I
thought I'd report the problem and I am happy to provide more detailed
data in order to fix it.