[sleuthkit-developers] TSK_FS_META_FLAG_COMP vs TSK_FS_ATTR_COMP

[Jon S. <jo...@li...>]

I just noticed this on an NTFS compressed file.
TSK_FS_FILE->meta->flags has TSK_FS_META_FLAG_COMP set on it, but the
non-resident data attribute of the runs does _not_ have
TSK_FS_ATTR_COMP set on it. Other NTFS compressed files on the same
image have both flags set, respectively.

How could it happen that the primary non-resident data attribute of a
compressed file not have the compressed flag (TSK_FS_ATTR_COMP) set on
it? Is it because the meta structure is unallocated?


Jon
-- 
Jon Stewart, Principal
(646) 719-0317 | jo...@li... | Arlington, VA