Re: [sleuthkit-users] hashing a file system

[Stuart M. <st...@ap...>]

On 09/09/2014 07:13 PM, Brian Carrier wrote:
> The FILLER entries are there for basic record keeping because NTFS makes not guarantees that the runs will be stored in consecutive order. TSK adds the FILLER entries when it gets runs out of order and pops them out as it finds them.
>
> Is the data you are describing below from the same Ext4 image you mentioned before?
>
> brian
>
>
Hi Brian, yes it is.  Does that shed any light on things?  I am still 
confused as to what fillers actually are and whether a file system is 
suspect should tsk tools announce that they have found some ;)

Stuart