[sleuthkit-users] AddImageProcess Problem with NTFS partition

[Luís F. N. <lfc...@gm...>]

Hi,

AddImageProcess is not being able to decode the directory tree of a NTFS
partition with dozens of thousands of files (none of them was located). The
following error is shown:

"Error in metadata structure (Extension record 148369 (file ref = 0) is not
for attribute list of 148368) (Error walking directory in file system at
offset 869269504)"

I attached the first 100KB of the referenced partition. Any help will be
appreciated.

Thank you,
Luis