Re: [sleuthkit-users] get an error block length

[Brian C. <ca...@sl...>]

This message occurs when TSK can’t decompress an NTFS compressed file (NTFS can store files compressed). In this case, the clue is “Status: Deleted”, which means that the sector that the file used to occupy has been re-used by another file.  TSK is trying to interpret that new data as though it were the compressed data and is having problems. 

You should expect some errors every now and then with deleted files. 

> On Jul 25, 2016, at 3:46 AM, expert66 <exp...@ya...> wrote:
> 
> Hi, i am using icat in my script and on some image file i have got an errors
> looks like: "Error extracting file from image (ntfs_uncompress_compunit:
> Block length longer than buffer length: 27056) (208010 - type: 128 id: 4
> Status: Deleted)"
> Can you help me: what does it mean and how i can fix it? Thanks.
> 
> 
> 
> --
> View this message in context: http://filesystems.996266.n3.nabble.com/get-an-error-block-length-tp9590.html
> Sent from the sleuthkit-users mailing list archive at Nabble.com.
> 
> ------------------------------------------------------------------------------
> What NetFlow Analyzer can do for you? Monitors network bandwidth and traffic
> patterns at an interface-level. Reveals which users, apps, and protocols are 
> consuming the most bandwidth. Provides multi-vendor support for NetFlow, 
> J-Flow, sFlow and other flows. Make informed decisions using capacity planning
> reports.http://sdm.link/zohodev2dev
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org