Re: [sleuthkit-users] file oddity

[Brian C. <ca...@sl...>]

Hi Stuart,

I'm wondering if the file in question is sparse and Ext4 isn't properly dealing with that.   I made an issue for it. Any debugging help would be appreciated though to verify that in the original file. 

brian


On Sep 3, 2014, at 3:21 PM, Stuart Maclean <st...@ap...> wrote:

> I am using tsk 4.1.3 on Ubuntu, 64-bit machine.   /dev/sda1 is a ext4 
> filessytem.
> 
> I have an inode for which istat claims
> 
> allocated
> inode: 1322012
> size: 4296704
> direct blocks: 5289177
> 
> If I dd the file, I do indeed see 4296704 bytes produced. Somewhat 
> curiously, the first 1876 bytes appear to be 'regular content', in fact 
> utf-16 text  (the file itself is some sort of kde cache file), while the 
> remainder of the file, over 4MB, are all zeros.  According to dd that is.
> 
> Now, if I icat this file (icat also from 4.1.3), the icat produces only 
> 4096 bytes of content.  I presume this number reflects the fact that 
> istat said there was only a single block, and the fs block size is 
> 4096.  The icat output shows the same 1876 leading bytes as dd did, and 
> further has all zeros from there up to its 4096 byte length.
> 
> I am not quite sure what is going on.  I was under the impression that 
> icat and dd would give the same result for this file (and would for all 
> allocated files in general).
> 
> Any help appreciated.
> 
> Stuart
> 
> 
> ------------------------------------------------------------------------------
> Slashdot TV.  
> Video for Nerds.  Stuff that matters.
> http://tv.slashdot.org/
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org