Re: [sleuthkit-users] TSK-4.4 and SlackFiles

[Brian C. <ca...@sl...>]

Hi Luis,

My guess is that it's a file that has preallocated a large amount of space,
but that has not fully used it yet. NTFS allows this.  If you read the
file, TSK will only show you the space that is used.  Reading the slack,
gives you the rest.

If you run 'istat' on one of these files and send it along, we can confirm.

thanks,
brian


On Tue, Jan 31, 2017 at 7:04 AM, Luís Filipe Nassif <lfc...@gm...>
wrote:

> Hi folks,
>
> I am upgrading to tsk-4.4 to benefit from the new support to slackfiles
> from java bindings. But I noticed some slackfiles larger than the cluster
> size (4k) are created in database. Some of them have megabytes of size and
> its contents are accessible. Is it expected to have slackfiles larger than
> cluster size? Could someone explain?
>
> Thanks,
> Luis Nassif
>
> ------------------------------------------------------------
> ------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, SlashDot.org! http://sdm.link/slashdot
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>
>