[sleuthkit-users] file oddity, follow up

[Stuart M. <st...@ap...>]

To follow up my recent post concerning icat and dd differences, I 
suspect my file in question has 'missing runs', i.e. the file content 
fits in a single block, and so the remainder of the advertised file size 
can be produced by the OS as all zeros.

Looking at the docs for tsk_fs_file_read, which I suspect is used by 
icat, I note

"0s are returned for missing runs of files"

Does that mean the 'return value', or that '0s are inserted into the 
user buffer'

and

"Returns the number of bytes read or -1 on error"

Does that mean  the actual byte count read off disk, which would be 0 
for a 'missing run' or does the return value accommodate a missing run, 
and return any count of 'produced zeros'?

Again, and help appreciated.

Stu