[sleuthkit-developers] TSK_FS_ATTR.nrd.skip_len

[Jon S. <jo...@li...>]

Can someone describe a filesystem and associated condition wherein a
file could have a data attribute with nrd.skip_len that's non-zero? I
would love to create some test evidence where this value is non-zero,
but I don't know how.

Does TSK_FS_ATTR_RUN.offset take skip_len into account? If skip_len >
0, it would seem likely that the associated TSK_FS_ATTR_RUN.offset
values could be erroneous.

Thanks,

Jon
-- 
Jon Stewart, Principal
(646) 719-0317 | jo...@li... | Arlington, VA