Re: [sleuthkit-users] Tsk_loaddb generating an inconsistent file system tree
Brought to you by:
carrier
From: Luís F. N. <lfc...@gm...> - 2016-03-29 14:14:56
|
MFT Entry Header Values: Entry: 24765 Sequence: 514 $LogFile Sequence Number: 18426169393 Allocated Directory Links: 2 $STANDARD_INFORMATION Attribute Values: Flags: Owner ID: 0 Security ID: 1915 (S-1-5-21-1420377728-1435070833-5377028-1000) Last User Journal Update Sequence Number: 3021062824 Created: 2014-01-21 22:25:14.139789800 (HorFile Modified: 2014-03-10 13:56:09.287806600 (Hora oficial do Brasil) MFT Modified: 2014-03-23 16:48:56.241901700 (Hora oficial do Brasil) Accessed: 2014-03-10 13:56:09.287806600 (Hora oficial do Brasil) $FILE_NAME Attribute Values: Flags: Directory Name: 2001 FI Parent MFT Entry: 260633 Sequence: 2 Allocated Size: 0 Actual Size: 0 Created: 2014-01-21 22:25:14.139789800 (HorFile Modified: 2014-03-10 13:56:09.287806600 (Hora oficial do Brasil) MFT Modified: 2014-03-10 13:56:09.287806600 (Hora oficial do Brasil) Accessed: 2014-03-10 13:56:09.287806600 (Hora oficial do Brasil) $OBJECT_ID Attribute Values: Object Id: abdbf634-2b90-34a7-11e3-88342f05a13b Attributes: Type: $STANDARD_INFORMATION (16-0) Name: N/A Resident size: 72 Type: $FILE_NAME (48-13) Name: N/A Resident size: 80 Type: $FILE_NAME (48-14) Name: N/A Resident size: 82 Type: $OBJECT_ID (64-10) Name: N/A Resident size: 16 Type: $INDEX_ROOT (144-9) Name: $I30 Resident size: 176 Type: $INDEX_ALLOCATION (160-7) Name: $I30 Non-Resident size: 12288 init_size: 12288 1037942 1037943 1037944 Type: $BITMAP (176-8) Name: $I30 Resident size: 8 |