Re: [sleuthkit-users] MFT entry sequence numbers

[Svein Y. W. <sv...@wi...>]

>From the linux NTFS documentation project: 

-- quote --

Sequence Number

Number of times this mft record has been reused.

N.B. The increment (skipping zero) is done when the file isdeleted.

N.B. If this is set to zero it is left as zero.

-- unquote --


My understanding of this is: 

65535 (-1) is the first sequence number
1 is the second sequence number
2 is the third sequence number
etc

0 means that the sequence number is not used (possibly because the entry
shall not be reused because it is baad or for another reason)


Svein 


> -----Original Message-----
> From: sle...@li... [mailto:sleuthkit-
> use...@li...] On Behalf Of Svein Yngvar Willassen
> Sent: 28. august 2006 14:20
> To: sle...@li...
> Subject: [sleuthkit-users] MFT entry sequence numbers
> 
> 
> I'm looking at the MFT entry sequence numbers. I notice that while most of
> the entries have sequence number 1-100, there is also a fair amount with
> sequence number 65535 (0xffff).
> 
> Anyone know if this value is special and if so what it means?
> 
> Regards,
> 
> Svein Y. Willassen
> Researcher, Norwegian University of Technology and Science
> 
> 
> 
> -------------------------------------------------------------------------
> Using Tomcat but need to do more? Need to support web services, security?
> Get stuff done quickly with pre-integrated technology to make your job
> easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org