[sleuthkit-developers] File sizes reported by sleuthkit

[David K. <dmk...@gm...>]

Hi all,

A couple questions on file sizes calculated by TSK:

1) In NTFS, is the file metadata from MFT record(s) included in a
file's reported size?  If so, unused space in a record is ignored,
correct?  Generically, does file metadata from other file systems work
into a file's reported size?

2) What goes into calculating the reported size of directories?

3) I'm running some comparisons between file sizes reported between
sleuthkit 2.07, encase 5, and windows.  Uncommonly, some non-directory
file sizes are off.  For example, a test NTFS hard drive of around 30k
files shows several hundred files with mismatched size, and 90% of
those are off by 26 bytes.  Any ideas what might account for those 26
bytes?

Thanks much..