Re: [sleuthkit-users] AddImageProcess Problem with NTFS partition

[Simson G. <si...@ac...>]

You might try making a copy of the file system to another drive and then
running an NTFS recovery program, such as  chkdsk or a commercial program.
Not forensically sound, but at least you might get the data.

On Wed, Jan 7, 2015 at 11:44 AM, Luís Filipe Nassif <lfc...@gm...>
wrote:

> Hi,
>
> AddImageProcess is not being able to decode the directory tree of a NTFS
> partition with dozens of thousands of files (none of them was located). The
> following error is shown:
>
> "Error in metadata structure (Extension record 148369 (file ref = 0) is
> not for attribute list of 148368) (Error walking directory in file system
> at offset 869269504)"
>
> I attached the first 100KB of the referenced partition. Any help will be
> appreciated.
>
> Thank you,
> Luis
>
>
> ------------------------------------------------------------------------------
> Dive into the World of Parallel Programming! The Go Parallel Website,
> sponsored by Intel and developed in partnership with Slashdot Media, is
> your
> hub for all things parallel software development, from weekly thought
> leadership blogs to news, videos, case studies, tutorials and more. Take a
> look and join the conversation now. http://goparallel.sourceforge.net
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>
>