[sleuthkit-users] fiwalk output

[Jason W. <jwr...@gm...>]

All,


Does the dfxml output of fiwalk report whether a file object has been
reallocated? Fls will (indicated by realloc), but will fiwalk do the same?
I've come across this situation for a particular ntfs partition and have
found two references for the same inode in fiwalk. In know which one is the
allocated entry based off of fls, but I'm not sure of how that can be
identified in fiwalk. Does anyone have any suggestions?

Thanks,

Jason Wright