sleuthkit-developers Mailing List for The Sleuth Kit (Page 31)
Brought to you by:
carrier
Menu
▾
▴
sleuthkit-developers — A list to discuss development of new features of The Sleuth Kit and Autopsy
You can subscribe to this list here.
| 2003 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
|
Aug
(10) |
Sep
(2) |
Oct
|
Nov
(1) |
Dec
|
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2004 |
Jan
(22) |
Feb
(39) |
Mar
(8) |
Apr
(17) |
May
(10) |
Jun
(2) |
Jul
(6) |
Aug
(4) |
Sep
(1) |
Oct
(3) |
Nov
|
Dec
|
| 2005 |
Jan
(2) |
Feb
(6) |
Mar
(2) |
Apr
(2) |
May
(13) |
Jun
(2) |
Jul
|
Aug
|
Sep
(5) |
Oct
|
Nov
(2) |
Dec
|
| 2006 |
Jan
|
Feb
|
Mar
(1) |
Apr
|
May
(2) |
Jun
(9) |
Jul
(4) |
Aug
(2) |
Sep
|
Oct
(1) |
Nov
(9) |
Dec
(4) |
| 2007 |
Jan
(1) |
Feb
(2) |
Mar
|
Apr
(3) |
May
|
Jun
|
Jul
(6) |
Aug
|
Sep
(4) |
Oct
|
Nov
|
Dec
(2) |
| 2008 |
Jan
(4) |
Feb
|
Mar
|
Apr
(1) |
May
|
Jun
(9) |
Jul
(14) |
Aug
|
Sep
(5) |
Oct
(10) |
Nov
(4) |
Dec
(7) |
| 2009 |
Jan
(7) |
Feb
(10) |
Mar
(10) |
Apr
(19) |
May
(16) |
Jun
(3) |
Jul
(9) |
Aug
(5) |
Sep
(5) |
Oct
(16) |
Nov
(35) |
Dec
(30) |
| 2010 |
Jan
(4) |
Feb
(24) |
Mar
(25) |
Apr
(31) |
May
(11) |
Jun
(9) |
Jul
(11) |
Aug
(31) |
Sep
(11) |
Oct
(10) |
Nov
(15) |
Dec
(3) |
| 2011 |
Jan
(8) |
Feb
(17) |
Mar
(14) |
Apr
(2) |
May
(4) |
Jun
(4) |
Jul
(3) |
Aug
(7) |
Sep
(18) |
Oct
(8) |
Nov
(16) |
Dec
(1) |
| 2012 |
Jan
(9) |
Feb
(2) |
Mar
(3) |
Apr
(13) |
May
(10) |
Jun
(7) |
Jul
(1) |
Aug
(5) |
Sep
|
Oct
(3) |
Nov
(19) |
Dec
(3) |
| 2013 |
Jan
(16) |
Feb
(3) |
Mar
(2) |
Apr
(4) |
May
|
Jun
(3) |
Jul
(2) |
Aug
(17) |
Sep
(6) |
Oct
(1) |
Nov
|
Dec
(4) |
| 2014 |
Jan
(2) |
Feb
|
Mar
(3) |
Apr
(7) |
May
(6) |
Jun
(1) |
Jul
(18) |
Aug
|
Sep
(3) |
Oct
(1) |
Nov
(26) |
Dec
(7) |
| 2015 |
Jan
(5) |
Feb
(1) |
Mar
(2) |
Apr
|
May
(1) |
Jun
(1) |
Jul
(5) |
Aug
(7) |
Sep
(4) |
Oct
(1) |
Nov
(1) |
Dec
|
| 2016 |
Jan
(3) |
Feb
|
Mar
(1) |
Apr
|
May
(1) |
Jun
(13) |
Jul
(23) |
Aug
(2) |
Sep
(11) |
Oct
|
Nov
(1) |
Dec
|
| 2017 |
Jan
(4) |
Feb
|
Mar
|
Apr
(2) |
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
(2) |
Dec
|
| 2018 |
Jan
|
Feb
|
Mar
(2) |
Apr
|
May
(1) |
Jun
(3) |
Jul
|
Aug
|
Sep
(2) |
Oct
|
Nov
(2) |
Dec
|
| 2019 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
|
Aug
(2) |
Sep
|
Oct
|
Nov
|
Dec
|
| 2020 |
Jan
(4) |
Feb
|
Mar
|
Apr
|
May
|
Jun
(3) |
Jul
(5) |
Aug
(1) |
Sep
|
Oct
|
Nov
|
Dec
|
| 2021 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
(1) |
Dec
|
| 2024 |
Jan
|
Feb
(1) |
Mar
|
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
|
Dec
(1) |
|
From: SourceForge.net <no...@so...> - 2009-03-24 03:52:11
|
Feature Requests item #2677107, was opened at 2009-03-09 20:34 Message generated for change (Comment added) made by carrier You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477892&aid=2677107&group_id=55685 Please note that this message will contain a full copy of the comment thread, including the initial issue submission, for this request, not just the latest update. >Category: None Group: None Status: Open Priority: 5 Private: No Submitted By: Michael Cohen (scudette) Assigned to: Nobody/Anonymous (nobody) Summary: Sleuthkit restricts AFF support Initial Comment: The AFF library has a vnode interface allowing it to transparently support multiple image types, however in Sleuthkit we have code like (aff.c): else if (type == AF_IDENTIFY_AFF) { img_info->itype = TSK_IMG_TYPE_AFF_AFF; } else if (type == AF_IDENTIFY_AFD) { img_info->itype = TSK_IMG_TYPE_AFF_AFD; } else if (type == AF_IDENTIFY_AFM) { img_info->itype = TSK_IMG_TYPE_AFF_AFM; } else { tsk_error_reset(); tsk_errno = TSK_ERR_IMG_MAGIC; snprintf(tsk_errstr, TSK_ERRSTR_L, "aff_open: Not an AFF, AFD, or AFM file"); free(aff_info); if (tsk_verbose) tsk_fprintf(stderr, "Not an AFF/AFD/AFM file\n"); return NULL; } etc This does not allow afflib to present other types of images than those which sleuthkit specifically knows about. Sleuthkit should just trap errors from afflib and allow it to handle everything else by itself. I realise this might interfere with sleuthkit's own support for ewf etc. So maybe this should only be allowed where the -i switch is specifically given to use afflib. ---------------------------------------------------------------------- >Comment By: Brian Carrier (carrier) Date: 2009-03-23 22:52 Message: I think the way I want to resolve this is to create a special image file type that enables the non-tested AFF formats. In general, I do not want to enable features that I am not sure how well they work and am not sure how much they have been tested because any bugs that existing in the image library will likely be reported as TSK bugs, which I then need to debug. Therefore, my plan is to allow the stable formats to be included in the autodetection methods and force the users to "opt-in" to the newer formats. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477892&aid=2677107&group_id=55685 |
|
From: SourceForge.net <no...@so...> - 2009-03-24 03:48:51
|
Bugs item #2708195, was opened at 2009-03-23 22:27 Message generated for change (Settings changed) made by carrier You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2708195&group_id=55685 Please note that this message will contain a full copy of the comment thread, including the initial issue submission, for this request, not just the latest update. Category: File System Tools Group: None >Status: Closed >Resolution: Fixed Priority: 5 Private: No Submitted By: Brian Carrier (carrier) Assigned to: Brian Carrier (carrier) Summary: error with long attribute reads Initial Comment: When reading large chunks of a fragmented attribute, the calculated offset could be wrong when it goes into the next run. ---------------------------------------------------------------------- Comment By: Brian Carrier (carrier) Date: 2009-03-23 22:48 Message: Reported by and patch by Jamie Butler. Checked into trunk: Sending CHANGES.txt Sending tsk3/fs/fs_attr.c Transmitting file data .. Committed revision 69. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2708195&group_id=55685 |
|
From: SourceForge.net <no...@so...> - 2009-03-24 03:48:44
|
Bugs item #2708195, was opened at 2009-03-23 22:27 Message generated for change (Comment added) made by carrier You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2708195&group_id=55685 Please note that this message will contain a full copy of the comment thread, including the initial issue submission, for this request, not just the latest update. Category: File System Tools Group: None Status: Open Resolution: None Priority: 5 Private: No Submitted By: Brian Carrier (carrier) Assigned to: Brian Carrier (carrier) Summary: error with long attribute reads Initial Comment: When reading large chunks of a fragmented attribute, the calculated offset could be wrong when it goes into the next run. ---------------------------------------------------------------------- >Comment By: Brian Carrier (carrier) Date: 2009-03-23 22:48 Message: Reported by and patch by Jamie Butler. Checked into trunk: Sending CHANGES.txt Sending tsk3/fs/fs_attr.c Transmitting file data .. Committed revision 69. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2708195&group_id=55685 |
|
From: SourceForge.net <no...@so...> - 2009-03-24 03:27:18
|
Bugs item #2708195, was opened at 2009-03-23 22:27 Message generated for change (Tracker Item Submitted) made by carrier You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2708195&group_id=55685 Please note that this message will contain a full copy of the comment thread, including the initial issue submission, for this request, not just the latest update. Category: File System Tools Group: None Status: Open Resolution: None Priority: 5 Private: No Submitted By: Brian Carrier (carrier) Assigned to: Brian Carrier (carrier) Summary: error with long attribute reads Initial Comment: When reading large chunks of a fragmented attribute, the calculated offset could be wrong when it goes into the next run. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2708195&group_id=55685 |
|
From: SourceForge.net <no...@so...> - 2009-03-23 18:29:30
|
Bugs item #2706862, was opened at 2009-03-23 14:29 Message generated for change (Tracker Item Submitted) made by robjoyce You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2706862&group_id=55685 Please note that this message will contain a full copy of the comment thread, including the initial issue submission, for this request, not just the latest update. Category: File System Tools Group: None Status: Open Resolution: None Priority: 5 Private: No Submitted By: Rob (robjoyce) Assigned to: Nobody/Anonymous (nobody) Summary: Handle uninitialized mode bits in HFS+ Initial Comment: According to Apple TN1150 (http://developer.apple.com/technotes/tn/tn1150.html#HFSPlusPermissions), it's legal for the permissions structure to be uninitialized. In the current SleuthKit trunk, the inode type never gets set in this case. (In SleuthKit 3.0.1, hfs_dinode_copy actually throws an error when this occurs.) The attached patch sets the inode type to directory or file as appropriate if it's initially empty (based on the catalog node type). It also sets the owner UID and GID to 99 ("unknown"), which are what the Mac OS HFS+ implementation does when it sees uninitialized permission structures. (You could reasonably argue SleuthKit shouldn't do the latter, although I think it's better than conflating root (UID/GID 0) versus "uninitialized".) ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2706862&group_id=55685 |
|
From: SourceForge.net <no...@so...> - 2009-03-10 02:46:46
|
Bugs item #2677107, was opened at 2009-03-10 12:34 Message generated for change (Tracker Item Submitted) made by Item Submitter You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2677107&group_id=55685 Please note that this message will contain a full copy of the comment thread, including the initial issue submission, for this request, not just the latest update. Category: Image File Tools Group: None Status: Open Resolution: None Priority: 5 Private: No Submitted By: Michael Cohen (scudette) Assigned to: Nobody/Anonymous (nobody) Summary: Sleuthkit restricts AFF support Initial Comment: The AFF library has a vnode interface allowing it to transparently support multiple image types, however in Sleuthkit we have code like (aff.c): else if (type == AF_IDENTIFY_AFF) { img_info->itype = TSK_IMG_TYPE_AFF_AFF; } else if (type == AF_IDENTIFY_AFD) { img_info->itype = TSK_IMG_TYPE_AFF_AFD; } else if (type == AF_IDENTIFY_AFM) { img_info->itype = TSK_IMG_TYPE_AFF_AFM; } else { tsk_error_reset(); tsk_errno = TSK_ERR_IMG_MAGIC; snprintf(tsk_errstr, TSK_ERRSTR_L, "aff_open: Not an AFF, AFD, or AFM file"); free(aff_info); if (tsk_verbose) tsk_fprintf(stderr, "Not an AFF/AFD/AFM file\n"); return NULL; } etc This does not allow afflib to present other types of images than those which sleuthkit specifically knows about. Sleuthkit should just trap errors from afflib and allow it to handle everything else by itself. I realise this might interfere with sleuthkit's own support for ewf etc. So maybe this should only be allowed where the -i switch is specifically given to use afflib. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2677107&group_id=55685 |
|
From: SourceForge.net <no...@so...> - 2009-03-10 01:20:53
|
Bugs item #2677069, was opened at 2009-03-09 21:20 Message generated for change (Tracker Item Submitted) made by Item Submitter You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2677069&group_id=55685 Please note that this message will contain a full copy of the comment thread, including the initial issue submission, for this request, not just the latest update. Category: Media Management Tools Group: None Status: Open Resolution: None Priority: 5 Private: No Submitted By: Aaron Burghardt (aburgh) Assigned to: Nobody/Anonymous (nobody) Summary: GPT Partitions not detected Initial Comment: When using tsk_vs_open() with TSK_VS_TYPE_DETECT to open an image and detect the volume system, GPT partition schemes are not detected. Currently, the code detects GPT's DOS safety partition scheme, then finds the GPT partition scheme but considers that an error. A simple patch is attached which discards the DOS volume system when a GPT volume system is also detected. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2677069&group_id=55685 |
|
From: SourceForge.net <no...@so...> - 2009-03-04 16:02:16
|
Bugs item #2662168, was opened at 2009-03-04 11:02 Message generated for change (Tracker Item Submitted) made by Item Submitter You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2662168&group_id=55685 Please note that this message will contain a full copy of the comment thread, including the initial issue submission, for this request, not just the latest update. Category: Image File Tools Group: None Status: Open Resolution: None Priority: 5 Private: No Submitted By: Rob (robjoyce) Assigned to: Nobody/Anonymous (nobody) Summary: Alignment errors when reading raw devices in Mac OS X Initial Comment: When running any SleuthKit tools against /dev/rdisk* in Mac OS X, you get kernel[0]: disk0: alignment error. messages in syslog. The tools work fine, despite the errors. Tracking it down, it turns out to be the lseek(...,SEEK_END) in tsk3/img/raw.c that tries to determine the file's size. There's already some Mac-specific code there to get the size of raw disk devices... the attached patch simply avoids the lseek() test if it's a character device on a Mac. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2662168&group_id=55685 |
|
From: SourceForge.net <no...@so...> - 2009-03-02 23:41:59
|
Bugs item #2655831, was opened at 2009-03-02 18:41 Message generated for change (Tracker Item Submitted) made by Item Submitter You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2655831&group_id=55685 Please note that this message will contain a full copy of the comment thread, including the initial issue submission, for this request, not just the latest update. Category: sorter Group: None Status: Open Resolution: None Priority: 5 Private: No Submitted By: Brian Carrier (carrier) Assigned to: Nobody/Anonymous (nobody) Summary: sorter does not know Ext2 Ext3 types Initial Comment: Sorter is hard coded for some file system types and it does not know about the shortened ext2 and ext3 names. Using ext by itself works though. From: Vinogratzky Date: February 27, 2009 2:28:28 AM EST To: sle...@li... Subject: [sleuthkit-users] sorter error:Unknown file system type: -f ext3 Hi, root@maus:~$ sorter -V The Sleuth Kit ver 3.0.1 root@maus:~$ sorter -s -d sorter_dir/ sda2.dd Unknown file system type: -f ext3 ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2655831&group_id=55685 |
|
From: Brian C. <ca...@sl...> - 2009-03-02 23:26:48
|
Thanks Simson. I fixed the fatfs, ntfs, and dls_lib ones. I hadn't seen those before. The other ones I've seen before, but do not have a good solution for them. They exist because TSK has typedefs for the offset and address types and a corresponding #define values for printing the values in printf statements. For example: typedef int64_t TSK_OFF_T; #define PRIuOFF PRIu64 C++ compilers keep track of types better then the C compilers and they complain that TSK_OFF_T is its own type, but that PRIuOFF is for a long long (or something). I haven't found a way to fix these warnings. Any ideas? brian On Feb 26, 2009, at 5:44 PM, Simson Garfinkel wrote: > Compiling SleuthKit 3.0.1 on 64-bit Ubuntu generates a whole bunch of > compile warnings. Most of these look harmless, but the ones in > fatfs.c may be of concern. > > fatfs.c:777: warning: array subscript is above array bounds > fatfs.c:777: warning: array subscript is above array bounds > fatfs.c:777: warning: array subscript is above array bounds > fatfs.c:817: warning: array subscript is above array bounds > fatfs.c:817: warning: array subscript is above array bounds > fatfs.c:817: warning: array subscript is above array bounds > ntfs.c:3640: warning: array subscript is above array bounds > ntfs.c:3723: warning: array subscript is above array bounds > ntfs.c:1620: warning: array subscript is above array bounds > ntfs.c:1997: warning: array subscript is above array bounds > dls_lib.c:129: warning: ignoring return value of 'fwrite', declared > with attribute warn_unused_result > dls_lib.c:135: warning: ignoring return value of 'fwrite', declared > with attribute warn_unused_result > disk_stat.cpp:83: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 2 has type ‘uint64_t’ > disk_stat.cpp:84: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 2 has type ‘uint64_t’ > disk_stat.cpp:88: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 2 has type ‘long unsigned int’ > disk_stat.cpp:88: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 3 has type ‘uint64_t’ > disk_sreset.cpp:94: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 2 has type ‘long unsigned int’ > disk_sreset.cpp:94: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 3 has type ‘uint64_t’ > read_apis.cpp:44: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 3 has type ‘TSK_OFF_T’ > read_apis.cpp:44: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 4 has type ‘TSK_OFF_T’ > read_apis.cpp:66: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 3 has type ‘TSK_OFF_T’ > read_apis.cpp:66: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 4 has type ‘TSK_OFF_T’ > read_apis.cpp:83: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 3 has type ‘TSK_OFF_T’ > read_apis.cpp:83: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 4 has type ‘TSK_OFF_T’ > read_apis.cpp:91: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 3 has type ‘TSK_OFF_T’ > read_apis.cpp:91: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 4 has type ‘TSK_INUM_T’ > read_apis.cpp:106: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 3 has type ‘TSK_OFF_T’ > read_apis.cpp:113: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 3 has type ‘TSK_DADDR_T’ > read_apis.cpp:122: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 3 has type ‘TSK_DADDR_T’ > read_apis.cpp:122: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 4 has type ‘TSK_INUM_T’ > read_apis.cpp:131: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 3 has type ‘TSK_OFF_T’ > read_apis.cpp:142: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 3 has type ‘TSK_OFF_T’ > read_apis.cpp:151: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 3 has type ‘TSK_OFF_T’ > read_apis.cpp:151: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 4 has type ‘TSK_INUM_T’ > read_apis.cpp:173: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 3 has type ‘TSK_INUM_T’ > read_apis.cpp:179: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 3 has type ‘TSK_INUM_T’ > read_apis.cpp:186: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 3 has type ‘TSK_INUM_T’ > read_apis.cpp:205: warning: deprecated conversion from string constant > to ‘char*’ > read_apis.cpp:243: warning: deprecated conversion from string constant > to ‘char*’ > read_apis.cpp:278: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 3 has type ‘TSK_OFF_T’ > read_apis.cpp:338: warning: deprecated conversion from string constant > to ‘char*’ > read_apis.cpp:366: warning: deprecated conversion from string constant > to ‘char*’ > read_apis.cpp:379: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 4 has type ‘TSK_OFF_T’ > read_apis.cpp:414: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 3 has type ‘TSK_INUM_T’ > read_apis.cpp:414: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 4 has type ‘TSK_INUM_T’ > read_apis.cpp:414: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 5 has type ‘TSK_INUM_T’ > read_apis.cpp:481: warning: deprecated conversion from string constant > to ‘char*’ > read_apis.cpp:516: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 3 has type ‘TSK_OFF_T’ > read_apis.cpp:583: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 3 has type ‘TSK_OFF_T’ > read_apis.cpp:600: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 3 has type ‘long int’ > read_apis.cpp:616: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 3 has type ‘long int’ > read_apis.cpp:632: warning: deprecated conversion from string constant > to ‘char*’ > read_apis.cpp:672: warning: deprecated conversion from string constant > to ‘char*’ > fs_fname_apis.cpp:47: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 3 has type ‘long unsigned int’ > fs_fname_apis.cpp:47: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 4 has type ‘long unsigned int’ > fs_fname_apis.cpp:115: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 3 has type ‘TSK_INUM_T’ > fs_fname_apis.cpp:126: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 3 has type ‘TSK_INUM_T’ > fs_fname_apis.cpp:135: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 3 has type ‘TSK_INUM_T’ > fs_fname_apis.cpp:148: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 4 has type ‘TSK_INUM_T’ > fs_fname_apis.cpp:157: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 4 has type ‘TSK_INUM_T’ > fs_fname_apis.cpp:166: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 3 has type ‘TSK_INUM_T’ > fs_fname_apis.cpp:206: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 3 has type ‘TSK_INUM_T’ > fs_fname_apis.cpp:242: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 4 has type ‘TSK_INUM_T’ > fs_fname_apis.cpp:242: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 5 has type ‘TSK_INUM_T’ > fs_fname_apis.cpp:253: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 3 has type ‘TSK_INUM_T’ > fs_fname_apis.cpp:253: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 4 has type ‘TSK_INUM_T’ > fs_fname_apis.cpp:253: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 6 has type ‘TSK_INUM_T’ > fs_fname_apis.cpp:263: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 3 has type ‘TSK_INUM_T’ > fs_fname_apis.cpp:263: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 5 has type ‘TSK_INUM_T’ > fs_fname_apis.cpp:274: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 6 has type ‘TSK_INUM_T’ > fs_fname_apis.cpp:291: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 3 has type ‘TSK_INUM_T’ > fs_fname_apis.cpp:301: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 3 has type ‘TSK_INUM_T’ > fs_fname_apis.cpp:322: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 4 has type ‘TSK_INUM_T’ > fs_fname_apis.cpp:332: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 4 has type ‘TSK_INUM_T’ > fs_fname_apis.cpp:362: warning: deprecated conversion from string > constant to ‘char*’ > fs_fname_apis.cpp:402: warning: deprecated conversion from string > constant to ‘char*’ > fs_attrlist_apis.cpp:34: warning: format ‘%llu’ expects type ‘long > long unsigned int’, but argument 3 has type ‘TSK_INUM_T’ > fs_attrlist_apis.cpp:43: warning: format ‘%llu’ expects type ‘long > long unsigned int’, but argument 4 has type ‘TSK_INUM_T’ > fs_attrlist_apis.cpp:67: warning: format ‘%llu’ expects type ‘long > long unsigned int’, but argument 3 has type ‘TSK_INUM_T’ > fs_attrlist_apis.cpp:75: warning: format ‘%llu’ expects type ‘long > long unsigned int’, but argument 3 has type ‘TSK_INUM_T’ > fs_attrlist_apis.cpp:86: warning: format ‘%llu’ expects type ‘long > long unsigned int’, but argument 4 has type ‘TSK_INUM_T’ > fs_attrlist_apis.cpp:95: warning: format ‘%llu’ expects type ‘long > long unsigned int’, but argument 5 has type ‘TSK_INUM_T’ > fs_attrlist_apis.cpp:103: warning: format ‘%llu’ expects type ‘long > long unsigned int’, but argument 7 has type ‘TSK_INUM_T’ > fs_attrlist_apis.cpp:110: warning: format ‘%llu’ expects type ‘long > long unsigned int’, but argument 5 has type ‘TSK_INUM_T’ > fs_attrlist_apis.cpp:119: warning: format ‘%llu’ expects type ‘long > long unsigned int’, but argument 4 has type ‘TSK_INUM_T’ > fs_attrlist_apis.cpp:126: warning: format ‘%llu’ expects type ‘long > long unsigned int’, but argument 5 has type ‘TSK_INUM_T’ > fs_attrlist_apis.cpp:135: warning: format ‘%llu’ expects type ‘long > long unsigned int’, but argument 4 has type ‘TSK_INUM_T’ > fs_attrlist_apis.cpp:141: warning: format ‘%llu’ expects type ‘long > long unsigned int’, but argument 5 has type ‘TSK_INUM_T’ > fs_attrlist_apis.cpp:151: warning: format ‘%llu’ expects type ‘long > long unsigned int’, but argument 4 has type ‘TSK_INUM_T’ > fs_attrlist_apis.cpp:157: warning: format ‘%llu’ expects type ‘long > long unsigned int’, but argument 5 has type ‘TSK_INUM_T’ > fs_attrlist_apis.cpp:177: warning: deprecated conversion from string > constant to ‘char*’ > fs_attrlist_apis.cpp:218: warning: deprecated conversion from string > constant to ‘char*’ > posix-style.cpp:66: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 3 has type ‘TSK_INUM_T’ > posix-style.cpp:93: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 4 has type ‘TSK_INUM_T’ > posix-style.cpp:214: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 3 has type ‘TSK_OFF_T’ > posix-style.cpp:229: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 3 has type ‘TSK_OFF_T’ > callback-style.cpp:94: warning: format ‘%llu’ expects type ‘long long > unsigned int’, but argument 4 > ---------------------------------------------------------------------- > -------- > Open Source Business Conference (OSBC), March 24-25, 2009, San > Francisco, CA > -OSBC tackles the biggest issue in open source: Open Sourcing the > Enterprise > -Strategies to boost innovation and cut costs with open source > participation > -Receive a $600 discount off the registration fee with the source > code: SFAD > http://p.sf.net/sfu/XcvMzF8H > _______________________________________________ > sleuthkit-users mailing list > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users > http://www.sleuthkit.org |
|
From: SourceForge.net <no...@so...> - 2009-02-27 12:18:45
|
Bugs item #2645156, was opened at 2009-02-27 12:17 Message generated for change (Tracker Item Submitted) made by Item Submitter You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2645156&group_id=55685 Please note that this message will contain a full copy of the comment thread, including the initial issue submission, for this request, not just the latest update. Category: None Group: None Status: Open Resolution: None Priority: 5 Private: No Submitted By: Charlie Daly (charliedaly) Assigned to: Nobody/Anonymous (nobody) Summary: FAT16 slack space not collected by blkls Initial Comment: blkls (Sleuth Kit ver 3.0.1) does not correctly collect slack space from a particular FAT16 partition. Image: http://polya.computing.dcu.ie/FATimage.dd of a virtual 1G drive and a FAT16 partition. There are a few directories and files. The command blkls -s -o 63 FATimage | xxd -a | less does not correctly collect the slack space. Using dls (Sleuth Kit ver 2.52) does collect the slack space correctly. Highest regards, Charlie ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2645156&group_id=55685 |
|
From: Brian C. <ca...@sl...> - 2009-02-14 04:09:30
|
As a reminder, I am planning on removing disktools from 3.1.0 because hdparam seems to have all of the DCO and HPA features and the TSK disk tools have not been well maintained in the past couple of years. If someone wants to take the lead on the fixes required for the tools, let me know ASAP. thanks, brian |
|
From: SourceForge.net <no...@so...> - 2009-02-14 04:04:25
|
Bugs item #2582734, was opened at 2009-02-09 16:19 Message generated for change (Comment added) made by carrier You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2582734&group_id=55685 Please note that this message will contain a full copy of the comment thread, including the initial issue submission, for this request, not just the latest update. Category: File System Tools Group: None >Status: Closed >Resolution: Invalid Priority: 5 Private: No Submitted By: Brian Carrier (carrier) Assigned to: Nobody/Anonymous (nobody) Summary: Remove TSK_FS_META_FLAG_ORPHAN flags Initial Comment: The TSK_FS_META_FLAG_ORPHAN is no longer needed, nor is the -p option to ils. They should be removed because they are not used or do not do anything now that there is the $OrphanFiles directory. ---------------------------------------------------------------------- >Comment By: Brian Carrier (carrier) Date: 2009-02-13 23:04 Message: It turns out that the META_FLAG_ORPHAN support still exists and is not hurting anything. So, I'll leave it in. However, I did change the description of the flag to note that it used only as an argument to inode_walk. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2582734&group_id=55685 |
|
From: SourceForge.net <no...@so...> - 2009-02-14 03:29:32
|
Bugs item #2596397, was opened at 2009-02-13 11:16 Message generated for change (Settings changed) made by carrier You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2596397&group_id=55685 Please note that this message will contain a full copy of the comment thread, including the initial issue submission, for this request, not just the latest update. Category: Timeline Tools Group: None >Status: Closed >Resolution: Fixed Priority: 5 Private: No Submitted By: Bruce Nikkel (bnikkel) >Assigned to: Brian Carrier (carrier) Summary: mactime sorting bug in TSK3 Initial Comment: Hi Brian, I think mactime in Sleuthkit3 is not sorting correctly when a filesystem contains timestamps older than Sept 9, 2001. In the version 3 mactime script, epoch time is now sorted as a string, not a number (like in v2). If a filesystem has timestamp strings less than 10 digits long (earlier than Sept 9, 2001), the resulting timeline will be incorrectly sorted/displayed. One way to fix this sorting bug is to add leading zeros to epoch timestamp strings under 10 digits. Adding the following code at line 317 in mactime 3.0.1 seems to solve the problem: # add leading zeros to timestamps # (corrects sorting bug) $st_mtime = sprintf("%.10d",$st_mtime); $st_atime = sprintf("%.10d",$st_atime); $st_ctime = sprintf("%.10d", $st_ctime); $st_crtime = sprintf("%.10d", $st_crtime); I don't know if this breaks things elsewhere, but from my brief tests it seemed to fix the problems I had with timelines containing older files. Kind regards, Bruce Nikkel ---------------------------------------------------------------------- >Comment By: Brian Carrier (carrier) Date: 2009-02-13 22:29 Message: Patch applied, verified, and checked into trunk. Sending CHANGES.txt Sending tools/timeline/mactime.base Transmitting file data .. Committed revision 62. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2596397&group_id=55685 |
|
From: SourceForge.net <no...@so...> - 2009-02-13 16:16:44
|
Bugs item #2596397, was opened at 2009-02-13 17:16 Message generated for change (Tracker Item Submitted) made by Item Submitter You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2596397&group_id=55685 Please note that this message will contain a full copy of the comment thread, including the initial issue submission, for this request, not just the latest update. Category: Timeline Tools Group: None Status: Open Resolution: None Priority: 5 Private: No Submitted By: Bruce Nikkel (bnikkel) Assigned to: Nobody/Anonymous (nobody) Summary: mactime sorting bug in TSK3 Initial Comment: Hi Brian, I think mactime in Sleuthkit3 is not sorting correctly when a filesystem contains timestamps older than Sept 9, 2001. In the version 3 mactime script, epoch time is now sorted as a string, not a number (like in v2). If a filesystem has timestamp strings less than 10 digits long (earlier than Sept 9, 2001), the resulting timeline will be incorrectly sorted/displayed. One way to fix this sorting bug is to add leading zeros to epoch timestamp strings under 10 digits. Adding the following code at line 317 in mactime 3.0.1 seems to solve the problem: # add leading zeros to timestamps # (corrects sorting bug) $st_mtime = sprintf("%.10d",$st_mtime); $st_atime = sprintf("%.10d",$st_atime); $st_ctime = sprintf("%.10d", $st_ctime); $st_crtime = sprintf("%.10d", $st_crtime); I don't know if this breaks things elsewhere, but from my brief tests it seemed to fix the problems I had with timelines containing older files. Kind regards, Bruce Nikkel ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2596397&group_id=55685 |
|
From: SourceForge.net <no...@so...> - 2009-02-13 14:47:08
|
Bugs item #2596153, was opened at 2009-02-13 09:47 Message generated for change (Tracker Item Submitted) made by Item Submitter You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2596153&group_id=55685 Please note that this message will contain a full copy of the comment thread, including the initial issue submission, for this request, not just the latest update. Category: File System Tools Group: None Status: Open Resolution: None Priority: 5 Private: No Submitted By: Brian Carrier (carrier) Assigned to: Nobody/Anonymous (nobody) Summary: tsk_img_open arguments Initial Comment: >From Simson Garfinkel: tsk_img_open_utf8 is prototyped: extern TSK_IMG_INFO *tsk_img_open_utf8(int num_img, const char **images, TSK_IMG_TYPE_ENUM type); where images is, I guess, argv. The problem is that getopt() prototypes argv this way: getopt(int argc, char * const argv[], const char *optstring); Passing argv to tsk_img_open_utf8 produces this error: error: invalid conversion from ‘char* const*’ to ‘const char**’ I can fix this with a cast, but perhaps tsk_img_open_utf8 should be changed to match. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2596153&group_id=55685 |
|
From: SourceForge.net <no...@so...> - 2009-02-13 14:45:32
|
Feature Requests item #2596148, was opened at 2009-02-13 09:45 Message generated for change (Tracker Item Submitted) made by Item Submitter You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477892&aid=2596148&group_id=55685 Please note that this message will contain a full copy of the comment thread, including the initial issue submission, for this request, not just the latest update. Category: File System Group: None Status: Open Priority: 5 Private: No Submitted By: Brian Carrier (carrier) Assigned to: Nobody/Anonymous (nobody) Summary: DMG and VMDK support via AFFLIB Initial Comment: >From Simson Garfinkel: Version 3.4.0 of AFFLIB (about to be released) offers transparent support for DMG and VMDK image formats using the QEMU layer. Attached is a set of context diffs which adapt SleuthKit to support DMG and VMDK through AFFLIB. You are welcome to incorporate them. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477892&aid=2596148&group_id=55685 |
|
From: SourceForge.net <no...@so...> - 2009-02-09 21:19:28
|
Bugs item #2582734, was opened at 2009-02-09 16:19 Message generated for change (Tracker Item Submitted) made by Item Submitter You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2582734&group_id=55685 Please note that this message will contain a full copy of the comment thread, including the initial issue submission, for this request, not just the latest update. Category: File System Tools Group: None Status: Open Resolution: None Priority: 5 Private: No Submitted By: Brian Carrier (carrier) Assigned to: Nobody/Anonymous (nobody) Summary: Remove TSK_FS_META_FLAG_ORPHAN flags Initial Comment: The TSK_FS_META_FLAG_ORPHAN is no longer needed, nor is the -p option to ils. They should be removed because they are not used or do not do anything now that there is the $OrphanFiles directory. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2582734&group_id=55685 |
|
From: SourceForge.net <no...@so...> - 2009-02-07 02:54:25
|
Bugs item #2568528, was opened at 2009-02-05 09:39 Message generated for change (Settings changed) made by carrier You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2568528&group_id=55685 Please note that this message will contain a full copy of the comment thread, including the initial issue submission, for this request, not just the latest update. Category: File System Tools Group: None >Status: Closed >Resolution: Fixed Priority: 5 Private: No Submitted By: Brian Carrier (carrier) Assigned to: Brian Carrier (carrier) Summary: Error adding attribute run Initial Comment: User is getting error about processing an NTFS file: Invalid API argument (fs_attr_add_run: error adding aditional run (11954): No filler entry for 2092. Final: 5078) ( - proc_attrseq: put run- proc_attrlist) Debug logs show that a filler entry should exist there. Debugging further... Reported by Andy Bontoft. ---------------------------------------------------------------------- >Comment By: Brian Carrier (carrier) Date: 2009-02-06 21:54 Message: Error was in adjustment of offset of filler entry. Fixed in trunk in revision 58. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2568528&group_id=55685 |
|
From: SourceForge.net <no...@so...> - 2009-02-05 14:40:06
|
Bugs item #2568528, was opened at 2009-02-05 09:39 Message generated for change (Tracker Item Submitted) made by Item Submitter You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2568528&group_id=55685 Please note that this message will contain a full copy of the comment thread, including the initial issue submission, for this request, not just the latest update. Category: File System Tools Group: None Status: Open Resolution: None Priority: 5 Private: No Submitted By: Brian Carrier (carrier) Assigned to: Brian Carrier (carrier) Summary: Error adding attribute run Initial Comment: User is getting error about processing an NTFS file: Invalid API argument (fs_attr_add_run: error adding aditional run (11954): No filler entry for 2092. Final: 5078) ( - proc_attrseq: put run- proc_attrlist) Debug logs show that a filler entry should exist there. Debugging further... Reported by Andy Bontoft. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2568528&group_id=55685 |
|
From: SourceForge.net <no...@so...> - 2009-01-25 04:02:32
|
Bugs item #2534449, was opened at 2009-01-24 22:57 Message generated for change (Comment added) made by carrier You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2534449&group_id=55685 Please note that this message will contain a full copy of the comment thread, including the initial issue submission, for this request, not just the latest update. Category: File System Tools Group: None >Status: Closed >Resolution: Fixed Priority: 5 Private: No Submitted By: Brian Carrier (carrier) Assigned to: Nobody/Anonymous (nobody) Summary: Extra NTFS file names in directory Initial Comment: 'fls' will report the unallocated versions of a file name if the MFT address was wiped to 0. % fls -o 32 -f ntfs -m c:/ img.bin.E0*| grep Doc 0|c:/Documents and Settings (deleted)|0|d/----------|0|0|0|0|0|0 0|c:/Documents and Settings|3666-144-6|d/drwxrwxrwx|0|0|56|1229403478|1200903286|1200903286|1200915835 This was found because it caused problems with 'ifind -n'. 'ifind' was grabbing the first entry entry, which points to 0 and cannot be recursed into. Reported by Andy Bontoft. ---------------------------------------------------------------------- >Comment By: Brian Carrier (carrier) Date: 2009-01-24 23:02 Message: Removed meta_addr check from fs_dir_add. Checked into trunk and 3.0 branch. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2534449&group_id=55685 |
|
From: SourceForge.net <no...@so...> - 2009-01-25 03:57:20
|
Bugs item #2534449, was opened at 2009-01-24 22:57 Message generated for change (Tracker Item Submitted) made by Item Submitter You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2534449&group_id=55685 Please note that this message will contain a full copy of the comment thread, including the initial issue submission, for this request, not just the latest update. Category: File System Tools Group: None Status: Open Resolution: None Priority: 5 Private: No Submitted By: Brian Carrier (carrier) Assigned to: Nobody/Anonymous (nobody) Summary: Extra NTFS file names in directory Initial Comment: 'fls' will report the unallocated versions of a file name if the MFT address was wiped to 0. % fls -o 32 -f ntfs -m c:/ img.bin.E0*| grep Doc 0|c:/Documents and Settings (deleted)|0|d/----------|0|0|0|0|0|0 0|c:/Documents and Settings|3666-144-6|d/drwxrwxrwx|0|0|56|1229403478|1200903286|1200903286|1200915835 This was found because it caused problems with 'ifind -n'. 'ifind' was grabbing the first entry entry, which points to 0 and cannot be recursed into. Reported by Andy Bontoft. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2534449&group_id=55685 |
|
From: SourceForge.net <no...@so...> - 2009-01-15 13:57:07
|
Feature Requests item #2509976, was opened at 2009-01-15 08:57 Message generated for change (Tracker Item Submitted) made by Item Submitter You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477892&aid=2509976&group_id=55685 Please note that this message will contain a full copy of the comment thread, including the initial issue submission, for this request, not just the latest update. Category: File System Group: None Status: Open Priority: 5 Private: No Submitted By: Brian Carrier (carrier) Assigned to: Nobody/Anonymous (nobody) Summary: Use Ext3 journal for file recovery Initial Comment: The Ext3 journal may contain copies of a file's inode before the file was deleted (Ext3 wipes block pointers when a file is deleted). Searching the journal for inodes may allow deleted files to be recovered. TSK can already parse the journal and cycle through it, but it does not actually use it. It probably should some how. There are obvious questions about usability though and how to identify that you want version X of file Y (where a version could be the current version of the inode or one of the previous versions). The design choice should also be applicable to NTFS because it stores data in a journal as well. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477892&aid=2509976&group_id=55685 |
|
From: SourceForge.net <no...@so...> - 2009-01-13 05:50:41
|
Bugs item #2490550, was opened at 2009-01-06 13:10 Message generated for change (Comment added) made by carrier You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2490550&group_id=55685 Please note that this message will contain a full copy of the comment thread, including the initial issue submission, for this request, not just the latest update. Category: File System Tools Group: None Status: Open Resolution: None Priority: 5 Private: No Submitted By: david kennedy (dmkennedy) Assigned to: Nobody/Anonymous (nobody) Summary: fls -r missing visible folders/files in NTFS, 2.52 and 3.0.0 Initial Comment: I have a disk with one NTFS partition that isn't showing some folders and files through fls -r. I've verified the file is missing in 3.0.0 as well as 2.52. I can't share the image itself; it has a bit of sensitive data. The folder turns up just fine in windows and linux. In a specific example, FLS is missing the folder and all files within it. The folder's inode number SHOULD be 30211 (located via another tool). istat gives the proper folder name in its output when directly accessing the inode. The folder's parent inode is 25442 on this image. Below is an istat for both the missing folder and the (fls-visible) parent folder, for both 3.0.0 and 2.52. Sleuthkit 2.52: istat for parent folder: istat /dev/sdb1 25442 MFT Entry Header Values: Entry: 25442 Sequence: 1 $LogFile Sequence Number: 16787693 Allocated Directory Links: 1 $STANDARD_INFORMATION Attribute Values: Flags: Archive Owner ID: 0 Created: Fri Dec 17 13:50:43 2004 File Modified: Fri Dec 17 13:54:38 2004 MFT Modified: Fri Dec 17 13:54:38 2004 Accessed: Tue Oct 28 14:17:49 2008 $FILE_NAME Attribute Values: Flags: Directory, Archive Name: I386 Parent MFT Entry: 2385 Sequence: 2408 Allocated Size: 0 Actual Size: 0 Created: Fri Dec 17 13:50:43 2004 File Modified: Fri Dec 17 13:54:38 2004 MFT Modified: Fri Dec 17 13:54:38 2004 Accessed: Fri Dec 17 13:54:38 2004 $ATTRIBUTE_LIST Attribute Values: Type: 16-0 MFT Entry: 25442 VCN: 0 Type: 48-2 MFT Entry: 25442 VCN: 0 Type: 144-9 MFT Entry: 25442 VCN: 0 Type: 160-1 MFT Entry: 27750 VCN: 0 Type: 160-11 MFT Entry: 25442 VCN: 1616 Type: 176-10 MFT Entry: 25442 VCN: 0 Attributes: Type: $STANDARD_INFORMATION (16-0) Name: N/A Resident size: 72 Type: $ATTRIBUTE_LIST (32-12) Name: N/A Resident size: 224 Type: $FILE_NAME (48-2) Name: N/A Resident size: 74 Type: $INDEX_ROOT (144-9) Name: $I30 Resident size: 56 Type: $INDEX_ALLOCATION (160-11) Name: $I30 Non-Resident size: 921600 9226806 9226807 9226808 9226809 9226810 9226811 9226812 9226813 8279563 8279564 8279565 8279566 8279567 8279568 8279569 8279570 8279583 8279584 8279585 8279586 8279587 8279588 8279589 8279590 562606 562607 562608 562609 562610 562611 562612 562613 4975729 4975730 4975731 4975732 4975733 4975734 4975735 4975736 5201957 5201958 5201959 5201960 5201961 5201962 5201963 5201964 6230377 6230378 6230379 6230380 6230381 6230382 6230383 6230384 6474510 6474511 6474512 6474513 6474514 6474515 6474516 6474517 6474518 6474519 6474520 6474521 6474522 6474523 6474524 6474525 6474769 6474770 6474771 6474772 6474773 6474774 6474775 6474776 7386954 7386955 7386956 7386957 7386958 7386959 7386960 7386961 8130144 8130145 8130146 8130147 8130148 8130149 8130150 8130151 8130260 8130261 8130262 8130263 8130264 8130265 8130266 8130267 8435605 8435606 8435607 8435608 8435609 8435610 8435611 8435612 9253264 9253265 9253266 9253267 9253268 9253269 9253270 9253271 12968399 12968400 12968401 12968402 12968403 12968404 12968405 12968406 12968619 12968620 12968621 12968622 12968623 12968624 12968625 12968626 8014380 8014381 8014382 8014383 8014384 8014385 8014386 8014387 4793927 4793928 4793929 4793930 4793931 4793932 4793933 4793934 6718054 6718055 6718056 6718057 6718058 6718059 6718060 6718061 6718701 6718702 6718703 6718704 6718705 6718706 6718707 6718708 6718709 6718710 6718711 6718712 6460765 6460766 6460767 6460768 8137826 8137827 8137828 8137829 8137830 8137831 8137832 8137833 Type: $BITMAP (176-10) Name: $I30 Resident size: 32 Type: $INDEX_ALLOCATION (160-1) Name: $I30 Non-Resident size: 921600 11830897 11830898 11830899 11830900 11830901 11830902 11830903 11830904 6029520 6029521 6029522 6029523 6029524 6029525 6029526 6029527 6029528 7956180 7956181 7956182 7956183 7956184 7956185 7956186 5620477 5620478 5620479 5620480 5620481 5620482 5620483 5620484 6156845 6156846 6156847 6156848 6156849 6156850 6156851 6156852 6156853 6156854 6156855 6156856 13093078 13093079 13093080 13093081 8796948 8796949 8796950 8796951 8796952 8796953 8796954 8796955 8027697 8027698 8027699 8027700 8027701 8027702 8027703 8027704 8027705 8027706 1630032 1630033 1630034 1630035 1630036 1630037 8918311 8918312 8918313 8918314 8918315 8918316 8918317 8918318 11905949 11905950 11905951 11905952 11905953 11905954 11905955 11905956 11935107 11935108 11935109 11935110 11935111 11935112 11935113 11935114 11935451 11935452 11935453 11935454 11935455 11935456 11935457 11935458 7877375 7877376 7877377 7877378 7877379 7877380 7877381 7877382 7877383 7877384 7877385 7877386 12826824 12826825 12826826 12826827 7338851 7338852 7338853 7338854 7338855 7338856 7338857 7338858 7338859 7338860 7338861 7338862 7338863 7338864 7338865 7338866 7338867 7338868 7338869 7338870 7338871 7338872 911045 911046 483475 483476 483477 483478 483479 483480 483481 483482 483483 483484 483485 483486 483487 483488 483489 483490 483491 483492 483493 483494 483495 483496 483497 6200808 8181505 8181506 8181507 8181508 8181509 8181510 8181511 8181512 8181513 8181514 8181515 8181516 8181517 8181518 8181519 8181520 4792800 4792801 4792802 4792803 4792804 4792805 4792806 4792807 12894781 12894782 12894783 12894784 12894785 12894786 12894787 12894788 189926 189927 189928 189929 189930 189931 189932 189933 189934 189935 189936 189937 189938 189939 189940 189941 8495448 8495449 8495450 8495451 8495452 8495453 8495454 8495455 8495456 8495457 5257243 5257244 5257245 5257246 5257247 5257248 1730855 1730856 1730857 1730858 1730859 1730860 1730861 1730862 6255617 6255618 6255619 6255620 6255621 6255622 6255623 6255624 8703778 8703779 8703780 8703781 8703782 8703783 8703784 8703785 8703786 8703787 5249521 5249522 5249523 5249524 5249525 5249526 7429665 7429666 7429667 7429668 7429669 7429670 7429671 7429672 955410 955411 955412 955413 955414 955415 955416 955417 970234 970235 970236 970237 970238 970239 970240 970241 970242 970243 970244 970245 970246 970247 970248 970249 970250 970251 970252 970253 970254 970255 970256 970257 970258 970259 970260 970261 970262 970263 970264 970265 970266 970267 970268 970269 970270 970271 970272 970273 970274 1557599 1557600 1557601 1557602 1557603 1557604 1557605 6034494 6034495 6034496 6034497 6034498 6034499 6034500 6034501 6034502 6034503 6034504 8158321 8158322 8158323 8158324 8158325 8158326 1431535 1431536 1431537 1431538 1431539 1431540 1431541 6295104 6295105 6295106 6295107 6295108 6295109 6295110 6295111 6295112 1603567 1603568 1603569 1603570 1603571 1603572 1603573 4921710 4921711 4921712 4921713 4921714 4921715 4921716 4921717 6584244 6584245 6584246 6584247 6584248 6584249 6584250 6584251 6584410 6584411 6584412 6584413 6584414 6584415 6584416 6584417 6584418 6584419 6584420 6584421 6584422 6584423 6584424 6038872 8025645 8025646 8025647 8025648 8025649 8025650 8025651 8025652 6941873 6941874 6941875 6941876 6941877 6941878 6941879 6941880 6496837 6496838 6496839 6496840 6496841 6496842 6496843 6496844 7114588 7114589 7114590 7114591 7114592 7114593 7114594 7114595 7560642 7560643 7560644 7560645 7560646 7560647 7560648 7560649 7331575 7331576 7331577 7331578 7331579 7331580 7331581 7331582 8083048 8083049 8083050 8083051 8083052 8083053 8083054 8083055 8083056 8083057 8083058 8083059 8083060 8083061 8083062 8083063 8083267 8083268 8083269 8083270 8083271 8083272 8083273 8083274 7377776 7377777 7377778 7377779 7377780 7377781 7377782 7377783 7377784 1661551 1661552 1661553 1661554 1661555 1661556 1661557 8581712 8581713 8581714 8581715 8581716 8581717 8581718 8581719 6560848 6560849 6560850 6560851 6560852 6560853 6560854 6560855 7600800 7600801 7600802 7600803 7600804 7600805 7600806 7600807 7600808 7600809 7600810 424818 424819 424820 424821 424822 424823 424824 436269 436270 436271 436272 436273 436274 436275 1748431 1748432 1748433 1748434 1748435 1748436 1748437 7632690 7632691 7632692 7632693 7632694 7632695 7632696 7632697 7632698 1749727 1749728 1749729 1749730 1749731 1749732 1749733 7627565 7627566 7627567 7627568 7627569 7627570 7627571 7627572 7627573 7627574 7627575 7627576 7627577 7627578 5834854 5834855 6505643 6505644 6505645 6505646 6505647 6505648 6505649 6505650 6506094 6506095 6506096 6506097 6506098 6506099 6506100 6506101 6506102 6506103 6506104 7363444 7363445 7363446 7363447 7363448 9009489 9009490 9009491 9009492 9009493 9009494 9009495 9009496 9009497 9009498 9009499 644210 644211 644212 644213 644214 644215 644216 660561 660562 660563 660564 660565 660566 660567 1408287 1408288 1408289 1408290 1408291 1408292 1408293 13082746 13082747 13082748 13082749 13082750 13082751 13082752 13082753 4973895 4973896 4973897 4973898 4973899 4973900 4973901 4973902 4973903 4973904 4973905 4973906 4973907 4973908 4973909 4973910 5499122 5499123 5499124 5499125 5499126 5499127 5499128 5499129 5686844 5686845 5686846 5686847 5686848 5686849 5686850 5686851 6049242 6049243 6049244 6049245 6049246 6049247 6049248 6049249 6049250 6049251 6049252 6049253 6049254 6049255 6049256 5501192 6251883 6251884 6251885 6251886 6251887 6251888 6251889 6251890 7625262 7625263 7625264 7625265 7625266 7625267 7625268 7625269 8284704 8284705 8284706 8284707 8284708 8284709 8284710 8284711 8284712 8284713 8284714 972343 972344 972345 972346 972347 972348 972349 1015127 1015128 1015129 1015130 1015131 1015132 1015133 1750367 1750368 1750369 1750370 1750371 1750372 1750373 5868453 5868454 5868455 5868456 5868457 5868458 5868459 5868460 8729227 8729228 8729229 8729230 8729231 8729232 8729233 8729234 8139874 8139875 8139876 8139877 8139878 8139879 8139880 8139881 7792415 7792416 7792417 7792418 7792419 7792420 7792421 7792422 7792423 7792424 7792425 7792426 1037517 1037518 1037519 1037520 1037521 1037522 1037523 1037533 1037534 1037535 1037536 1037537 1037538 1037539 1037581 1037582 1037583 1037584 1037585 1037586 1037587 1750719 1750720 1750721 1750722 1750723 1750724 1750725 798615 798616 798617 798618 798619 798620 798621 798622 798623 1750687 1750688 1750689 1750690 1750691 1750692 1750693 8707871 8707872 8707873 8707874 8707875 8707876 8707877 8707878 9031436 9031437 9031438 9031439 9031440 9031441 9031442 9031443 9031507 9031508 9031509 9031510 9031511 9031512 9031513 9031514 9031714 9031715 9031716 9031717 9031718 9031719 9031720 9031721 9031835 9031836 9031837 9031838 9031839 9031840 9031841 9031842 9031893 9031894 9031895 9031896 9031897 9031898 9031899 9031900 9032007 9032008 9032009 9032010 9032011 9032012 9032013 9032014 13069964 13069965 13069966 13069967 13069968 13069969 13069970 13069971 13070040 13070041 13070042 13070043 13070044 13070045 13070046 13070047 6051815 6051816 6051817 6051818 6051819 6051820 6051821 6051822 6071155 6071156 6071157 6071158 6071159 6071160 6071161 6071162 5387047 5387048 5387049 5387050 5387051 5387052 5387053 5387054 4691541 4691542 4691543 4691544 4691545 4691546 4691547 4691548 4691549 4691550 4691551 4691552 13070551 13070552 13070553 13070554 6079186 6079187 6079188 6079189 6079190 6079191 6079192 6079193 6413336 6413337 6413338 6413339 6413340 6413341 6413342 6413343 6413615 6413616 6413617 6413618 6413619 6413620 6413621 6413622 6900908 6900909 6900910 6900911 6900912 6900913 6900914 6900915 6900916 6900917 6900918 6900919 6900920 7346036 7346037 7346038 7346039 7346040 5932790 5932791 5932792 5932793 5932794 5932795 5932796 11827873 11827874 11827875 11827876 11827877 11827878 11827879 6306321 6306322 6306323 6306324 6306325 6306326 6306327 6306328 6092384 6092385 6092386 6092387 6092388 6092389 6092390 6092391 6092392 9401258 9401259 9401260 9401261 9401262 9401263 9401264 12955292 12955293 12955294 12955295 12955296 12955297 12955298 12955299 5112514 5112515 5112516 5112517 5112518 5112519 5112520 5112521 6911569 6911570 6911571 6911572 6911573 6911574 6911575 6911576 7101353 7101354 7101355 7101356 7101357 7101358 7101359 7101360 7101361 7101362 7101363 7101364 7101365 7101366 7101367 7101368 8712977 8712978 8712979 8712980 8712981 8712982 8712983 8712984 5334493 5334494 5334495 5334496 5334497 5334498 5334499 5334500 5334501 5334502 5334503 5334504 8359749 8359750 8359751 8359752 8359753 8359754 6544098 6544099 6544100 6544101 6544102 6544103 6544104 9337407 9337408 9337409 9337410 9337411 9337412 9337413 7552788 7552789 7552790 7552791 7552792 7552793 7552794 7552795 7553437 7553438 7553439 7553440 7553441 7553442 7553443 7553444 7553562 7553563 7553564 7553565 7553566 7553567 7553568 7553569 8792587 8792588 8792589 8792590 8792591 8792592 8792593 8792594 8792746 8792747 8792748 8792749 8792750 8792751 8792752 8792753 9214228 9214229 9214230 9214231 9214232 9214233 9214234 9214235 9214430 9214431 9214432 9214433 9214434 9214435 9214436 9214437 9214514 9214515 9214516 9214517 9214518 9214519 9214520 9214521 1030435 1030436 1030437 1030438 1030439 1030440 1030441 1030442 1030716 1030717 1030718 1030719 1030720 1030721 1030722 1030723 5264752 5264753 5264754 5264755 5264756 5264757 5264758 5264759 5265093 5265094 5265095 5265096 5265097 5265098 5265099 5265100 5265101 5621181 5621182 5621183 5621184 5621185 5621186 5621187 6891679 6891680 6891681 6891682 6891683 6891684 6891685 6891686 6891687 6891688 6891689 6891690 6891691 6891692 6891693 6891694 8104855 8104856 8104857 8104858 8104859 8104860 8104861 8104862 8104863 8104864 8104865 8104866 8104867 8104868 8104869 8104870 5227582 5227583 5227584 5227585 5227586 5227587 5227588 5227589 5227590 5227591 5227592 5227593 518818 518819 518820 518821 5375875 5375876 5375877 5375878 5375879 5375880 5375881 5375882 5403195 5403196 5403197 5403198 5403199 5403200 5403201 5403202 5403203 5403204 5403205 5403206 5403207 5403208 5403209 5403210 6064004 6064005 6064006 6064007 6064008 6064009 6064010 6064011 6179671 6179672 6179673 6179674 6179675 6179676 6179677 6179678 6315651 6315652 6315653 6315654 6315655 6315656 6315657 6315658 6705103 6705104 6705105 6705106 6705107 6705108 6705109 6705110 6705317 6705318 6705319 6705320 6705321 6705322 6705323 6705324 7744529 7744530 7744531 7744532 7744533 7744534 7744535 7744536 7745137 7745138 7745139 7745140 7745141 7745142 7745143 7745144 7903260 7903261 7903262 7903263 7903264 7903265 7903266 7903267 7968689 7968690 7968691 7968692 7968693 7968694 7968695 7968696 8113815 8113816 8113817 8113818 8113819 8113820 8113821 8113822 8539299 8539300 8539301 8539302 8539303 8539304 8539305 8539306 8572209 8572210 8572211 8572212 8572213 8572214 8572215 8572216 12760230 12760231 12760232 12760233 12760234 12760235 12760236 12760237 517148 517149 517150 517151 517152 517153 517154 517155 517367 517368 517369 517370 517371 517372 517373 517374 768822 768823 768824 768825 768826 768827 768828 768829 6071580 6071581 6071582 6071583 6071584 6071585 6071586 6071587 6072178 6072179 6072180 6072181 6072182 6072183 6072184 6072185 7001616 7001617 7001618 7001619 7001620 7001621 7001622 7001623 8400304 8400305 8400306 8400307 8400308 8400309 8400310 8400311 8400659 8400660 8400661 8400662 8400663 8400664 8400665 8400666 6210287 6210288 6210289 6210290 6210291 6210292 6210293 6210294 6212587 6212588 6212589 6212590 6212591 6212592 6212593 6212594 7567875 7567876 7567877 7567878 7567879 7567880 7567881 7567882 7531829 7531830 7531831 7531832 7531833 7531834 7531835 7531836 7531837 7531838 7531839 7531840 7531841 7531842 7531843 7531844 7531887 7531888 7531889 7531890 7531891 7531892 7531893 7531894 7206226 7206227 7206228 7206229 7206230 7206231 7206232 7206233 7206767 7206768 7206769 7206770 7206771 7206772 7206773 7206774 7206775 7206776 8049832 8049833 8049834 8049835 8049836 8049837 4987819 4987820 4987821 4987822 4987823 4987824 4987825 4987826 4988328 4988329 4988330 4988331 4988332 4988333 4988334 4988335 6074929 6074930 6074931 6074932 6074933 6074934 6074935 6074936 6075275 6075276 6075277 6075278 6075279 6075280 6075281 6075282 6075283 6075284 6075285 6075286 6075287 6075288 185018 185019 9087980 9087981 9087982 9087983 9087984 9087985 9087986 9087987 9088043 9088044 9088045 9088046 9088047 9088048 9088049 9088050 13112758 13112759 13112760 13112761 13112762 13112763 13112764 13112765 6744132 6744133 6744134 6744135 6744136 6744137 6744138 6744139 7639596 7639597 7639598 7639599 7639600 7639601 7639602 7639603 8715965 8715966 8715967 8715968 8715969 8715970 8715971 8715972 6073220 6073221 6073222 6073223 6073224 6073225 6073226 6073227 7208816 7208817 7208818 7208819 7208820 7208821 7208822 7208823 7208824 225944 225945 225946 225947 225948 225949 225950 9226706 9226707 9226708 9226709 9226710 9226711 9226712 9226713 istat for missing folder: istat /dev/sdb1 30211 MFT Entry Header Values: Entry: 30211 Sequence: 1 $LogFile Sequence Number: 16790486 Allocated Directory Links: 1 $STANDARD_INFORMATION Attribute Values: Flags: Archive Owner ID: 0 Created: Fri Dec 17 13:54:08 2004 File Modified: Fri Dec 17 13:54:08 2004 MFT Modified: Fri Dec 17 13:54:08 2004 Accessed: Tue Oct 28 14:18:01 2008 $FILE_NAME Attribute Values: Flags: Directory, Archive Name: UNIPROC Parent MFT Entry: 25442 Sequence: 1 Allocated Size: 0 Actual Size: 0 Created: Fri Dec 17 13:54:08 2004 File Modified: Fri Dec 17 13:54:08 2004 MFT Modified: Fri Dec 17 13:54:08 2004 Accessed: Fri Dec 17 13:54:08 2004 Attributes: Type: $STANDARD_INFORMATION (16-0) Name: N/A Resident size: 72 Type: $FILE_NAME (48-2) Name: N/A Resident size: 80 Type: $INDEX_ROOT (144-1) Name: $I30 Resident size: 680 Sleuthkit 3.00: istat for parent folder: ./istat /dev/sdb1 25442 MFT Entry Header Values: Entry: 25442 Sequence: 1 $LogFile Sequence Number: 16787693 Allocated Directory Links: 1 $STANDARD_INFORMATION Attribute Values: Flags: Archive Owner ID: 0 Created: Fri Dec 17 13:50:43 2004 File Modified: Fri Dec 17 13:54:38 2004 MFT Modified: Fri Dec 17 13:54:38 2004 Accessed: Tue Oct 28 14:17:49 2008 $FILE_NAME Attribute Values: Flags: Directory, Archive Name: I386 Parent MFT Entry: 2385 Sequence: 2408 Allocated Size: 0 Actual Size: 0 Created: Fri Dec 17 13:50:43 2004 File Modified: Fri Dec 17 13:54:38 2004 MFT Modified: Fri Dec 17 13:54:38 2004 Accessed: Fri Dec 17 13:54:38 2004 $ATTRIBUTE_LIST Attribute Values: Type: 16-0 MFT Entry: 25442 VCN: 0 Type: 48-2 MFT Entry: 25442 VCN: 0 Type: 144-9 MFT Entry: 25442 VCN: 0 Type: 160-1 MFT Entry: 27750 VCN: 0 Type: 160-11 MFT Entry: 25442 VCN: 1616 Type: 176-10 MFT Entry: 25442 VCN: 0 Attributes: Type: $STANDARD_INFORMATION (16-0) Name: N/A Resident size: 72 Type: $ATTRIBUTE_LIST (32-12) Name: N/A Resident size: 224 Type: $FILE_NAME (48-2) Name: N/A Resident size: 74 Type: $INDEX_ROOT (144-9) Name: $I30 Resident size: 56 Type: $INDEX_ALLOCATION (160-11) Name: $I30 Non-Resident size: 921600 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 9226806 9226807 9226808 9226809 9226810 9226811 9226812 9226813 8279563 8279564 8279565 8279566 8279567 8279568 8279569 8279570 8279583 8279584 8279585 8279586 8279587 8279588 8279589 8279590 562606 562607 562608 562609 562610 562611 562612 562613 4975729 4975730 4975731 4975732 4975733 4975734 4975735 4975736 5201957 5201958 5201959 5201960 5201961 5201962 5201963 5201964 6230377 6230378 6230379 6230380 6230381 6230382 6230383 6230384 6474510 6474511 6474512 6474513 6474514 6474515 6474516 6474517 6474518 6474519 6474520 6474521 6474522 6474523 6474524 6474525 6474769 6474770 6474771 6474772 6474773 6474774 6474775 6474776 7386954 7386955 7386956 7386957 7386958 7386959 7386960 7386961 8130144 8130145 8130146 8130147 8130148 8130149 8130150 8130151 8130260 8130261 8130262 8130263 8130264 8130265 8130266 8130267 8435605 8435606 8435607 8435608 8435609 8435610 8435611 8435612 9253264 9253265 9253266 9253267 9253268 9253269 9253270 9253271 12968399 12968400 12968401 12968402 12968403 12968404 12968405 12968406 12968619 12968620 12968621 12968622 12968623 12968624 12968625 12968626 8014380 8014381 8014382 8014383 8014384 8014385 8014386 8014387 4793927 4793928 4793929 4793930 4793931 4793932 4793933 4793934 6718054 6718055 6718056 6718057 6718058 6718059 6718060 6718061 6718701 6718702 6718703 6718704 6718705 6718706 6718707 6718708 6718709 6718710 6718711 6718712 6460765 6460766 6460767 6460768 8137826 8137827 8137828 8137829 8137830 8137831 8137832 8137833 Type: $BITMAP (176-10) Name: $I30 Resident size: 32 Type: $INDEX_ALLOCATION (160-1) Name: $I30 Non-Resident size: 921600 11830897 11830898 11830899 11830900 11830901 11830902 11830903 11830904 6029520 6029521 6029522 6029523 6029524 6029525 6029526 6029527 6029528 7956180 7956181 7956182 7956183 7956184 7956185 7956186 5620477 5620478 5620479 5620480 5620481 5620482 5620483 5620484 6156845 6156846 6156847 6156848 6156849 6156850 6156851 6156852 6156853 6156854 6156855 6156856 13093078 13093079 13093080 13093081 8796948 8796949 8796950 8796951 8796952 8796953 8796954 8796955 8027697 8027698 8027699 8027700 8027701 8027702 8027703 8027704 8027705 8027706 1630032 1630033 1630034 1630035 1630036 1630037 8918311 8918312 8918313 8918314 8918315 8918316 8918317 8918318 11905949 11905950 11905951 11905952 11905953 11905954 11905955 11905956 11935107 11935108 11935109 11935110 11935111 11935112 11935113 11935114 11935451 11935452 11935453 11935454 11935455 11935456 11935457 11935458 7877375 7877376 7877377 7877378 7877379 7877380 7877381 7877382 7877383 7877384 7877385 7877386 12826824 12826825 12826826 12826827 7338851 7338852 7338853 7338854 7338855 7338856 7338857 7338858 7338859 7338860 7338861 7338862 7338863 7338864 7338865 7338866 7338867 7338868 7338869 7338870 7338871 7338872 911045 911046 483475 483476 483477 483478 483479 483480 483481 483482 483483 483484 483485 483486 483487 483488 483489 483490 483491 483492 483493 483494 483495 483496 483497 6200808 8181505 8181506 8181507 8181508 8181509 8181510 8181511 8181512 8181513 8181514 8181515 8181516 8181517 8181518 8181519 8181520 4792800 4792801 4792802 4792803 4792804 4792805 4792806 4792807 12894781 12894782 12894783 12894784 12894785 12894786 12894787 12894788 189926 189927 189928 189929 189930 189931 189932 189933 189934 189935 189936 189937 189938 189939 189940 189941 8495448 8495449 8495450 8495451 8495452 8495453 8495454 8495455 8495456 8495457 5257243 5257244 5257245 5257246 5257247 5257248 1730855 1730856 1730857 1730858 1730859 1730860 1730861 1730862 6255617 6255618 6255619 6255620 6255621 6255622 6255623 6255624 8703778 8703779 8703780 8703781 8703782 8703783 8703784 8703785 8703786 8703787 5249521 5249522 5249523 5249524 5249525 5249526 7429665 7429666 7429667 7429668 7429669 7429670 7429671 7429672 955410 955411 955412 955413 955414 955415 955416 955417 970234 970235 970236 970237 970238 970239 970240 970241 970242 970243 970244 970245 970246 970247 970248 970249 970250 970251 970252 970253 970254 970255 970256 970257 970258 970259 970260 970261 970262 970263 970264 970265 970266 970267 970268 970269 970270 970271 970272 970273 970274 1557599 1557600 1557601 1557602 1557603 1557604 1557605 6034494 6034495 6034496 6034497 6034498 6034499 6034500 6034501 6034502 6034503 6034504 8158321 8158322 8158323 8158324 8158325 8158326 1431535 1431536 1431537 1431538 1431539 1431540 1431541 6295104 6295105 6295106 6295107 6295108 6295109 6295110 6295111 6295112 1603567 1603568 1603569 1603570 1603571 1603572 1603573 4921710 4921711 4921712 4921713 4921714 4921715 4921716 4921717 6584244 6584245 6584246 6584247 6584248 6584249 6584250 6584251 6584410 6584411 6584412 6584413 6584414 6584415 6584416 6584417 6584418 6584419 6584420 6584421 6584422 6584423 6584424 6038872 8025645 8025646 8025647 8025648 8025649 8025650 8025651 8025652 6941873 6941874 6941875 6941876 6941877 6941878 6941879 6941880 6496837 6496838 6496839 6496840 6496841 6496842 6496843 6496844 7114588 7114589 7114590 7114591 7114592 7114593 7114594 7114595 7560642 7560643 7560644 7560645 7560646 7560647 7560648 7560649 7331575 7331576 7331577 7331578 7331579 7331580 7331581 7331582 8083048 8083049 8083050 8083051 8083052 8083053 8083054 8083055 8083056 8083057 8083058 8083059 8083060 8083061 8083062 8083063 8083267 8083268 8083269 8083270 8083271 8083272 8083273 8083274 7377776 7377777 7377778 7377779 7377780 7377781 7377782 7377783 7377784 1661551 1661552 1661553 1661554 1661555 1661556 1661557 8581712 8581713 8581714 8581715 8581716 8581717 8581718 8581719 6560848 6560849 6560850 6560851 6560852 6560853 6560854 6560855 7600800 7600801 7600802 7600803 7600804 7600805 7600806 7600807 7600808 7600809 7600810 424818 424819 424820 424821 424822 424823 424824 436269 436270 436271 436272 436273 436274 436275 1748431 1748432 1748433 1748434 1748435 1748436 1748437 7632690 7632691 7632692 7632693 7632694 7632695 7632696 7632697 7632698 1749727 1749728 1749729 1749730 1749731 1749732 1749733 7627565 7627566 7627567 7627568 7627569 7627570 7627571 7627572 7627573 7627574 7627575 7627576 7627577 7627578 5834854 5834855 6505643 6505644 6505645 6505646 6505647 6505648 6505649 6505650 6506094 6506095 6506096 6506097 6506098 6506099 6506100 6506101 6506102 6506103 6506104 7363444 7363445 7363446 7363447 7363448 9009489 9009490 9009491 9009492 9009493 9009494 9009495 9009496 9009497 9009498 9009499 644210 644211 644212 644213 644214 644215 644216 660561 660562 660563 660564 660565 660566 660567 1408287 1408288 1408289 1408290 1408291 1408292 1408293 13082746 13082747 13082748 13082749 13082750 13082751 13082752 13082753 4973895 4973896 4973897 4973898 4973899 4973900 4973901 4973902 4973903 4973904 4973905 4973906 4973907 4973908 4973909 4973910 5499122 5499123 5499124 5499125 5499126 5499127 5499128 5499129 5686844 5686845 5686846 5686847 5686848 5686849 5686850 5686851 6049242 6049243 6049244 6049245 6049246 6049247 6049248 6049249 6049250 6049251 6049252 6049253 6049254 6049255 6049256 5501192 6251883 6251884 6251885 6251886 6251887 6251888 6251889 6251890 7625262 7625263 7625264 7625265 7625266 7625267 7625268 7625269 8284704 8284705 8284706 8284707 8284708 8284709 8284710 8284711 8284712 8284713 8284714 972343 972344 972345 972346 972347 972348 972349 1015127 1015128 1015129 1015130 1015131 1015132 1015133 1750367 1750368 1750369 1750370 1750371 1750372 1750373 5868453 5868454 5868455 5868456 5868457 5868458 5868459 5868460 8729227 8729228 8729229 8729230 8729231 8729232 8729233 8729234 8139874 8139875 8139876 8139877 8139878 8139879 8139880 8139881 7792415 7792416 7792417 7792418 7792419 7792420 7792421 7792422 7792423 7792424 7792425 7792426 1037517 1037518 1037519 1037520 1037521 1037522 1037523 1037533 1037534 1037535 1037536 1037537 1037538 1037539 1037581 1037582 1037583 1037584 1037585 1037586 1037587 1750719 1750720 1750721 1750722 1750723 1750724 1750725 798615 798616 798617 798618 798619 798620 798621 798622 798623 1750687 1750688 1750689 1750690 1750691 1750692 1750693 8707871 8707872 8707873 8707874 8707875 8707876 8707877 8707878 9031436 9031437 9031438 9031439 9031440 9031441 9031442 9031443 9031507 9031508 9031509 9031510 9031511 9031512 9031513 9031514 9031714 9031715 9031716 9031717 9031718 9031719 9031720 9031721 9031835 9031836 9031837 9031838 9031839 9031840 9031841 9031842 9031893 9031894 9031895 9031896 9031897 9031898 9031899 9031900 9032007 9032008 9032009 9032010 9032011 9032012 9032013 9032014 13069964 13069965 13069966 13069967 13069968 13069969 13069970 13069971 13070040 13070041 13070042 13070043 13070044 13070045 13070046 13070047 6051815 6051816 6051817 6051818 6051819 6051820 6051821 6051822 6071155 6071156 6071157 6071158 6071159 6071160 6071161 6071162 5387047 5387048 5387049 5387050 5387051 5387052 5387053 5387054 4691541 4691542 4691543 4691544 4691545 4691546 4691547 4691548 4691549 4691550 4691551 4691552 13070551 13070552 13070553 13070554 6079186 6079187 6079188 6079189 6079190 6079191 6079192 6079193 6413336 6413337 6413338 6413339 6413340 6413341 6413342 6413343 6413615 6413616 6413617 6413618 6413619 6413620 6413621 6413622 6900908 6900909 6900910 6900911 6900912 6900913 6900914 6900915 6900916 6900917 6900918 6900919 6900920 7346036 7346037 7346038 7346039 7346040 5932790 5932791 5932792 5932793 5932794 5932795 5932796 11827873 11827874 11827875 11827876 11827877 11827878 11827879 6306321 6306322 6306323 6306324 6306325 6306326 6306327 6306328 6092384 6092385 6092386 6092387 6092388 6092389 6092390 6092391 6092392 9401258 9401259 9401260 9401261 9401262 9401263 9401264 12955292 12955293 12955294 12955295 12955296 12955297 12955298 12955299 5112514 5112515 5112516 5112517 5112518 5112519 5112520 5112521 6911569 6911570 6911571 6911572 6911573 6911574 6911575 6911576 7101353 7101354 7101355 7101356 7101357 7101358 7101359 7101360 7101361 7101362 7101363 7101364 7101365 7101366 7101367 7101368 8712977 8712978 8712979 8712980 8712981 8712982 8712983 8712984 5334493 5334494 5334495 5334496 5334497 5334498 5334499 5334500 5334501 5334502 5334503 5334504 8359749 8359750 8359751 8359752 8359753 8359754 6544098 6544099 6544100 6544101 6544102 6544103 6544104 9337407 9337408 9337409 9337410 9337411 9337412 9337413 7552788 7552789 7552790 7552791 7552792 7552793 7552794 7552795 7553437 7553438 7553439 7553440 7553441 7553442 7553443 7553444 7553562 7553563 7553564 7553565 7553566 7553567 7553568 7553569 8792587 8792588 8792589 8792590 8792591 8792592 8792593 8792594 8792746 8792747 8792748 8792749 8792750 8792751 8792752 8792753 9214228 9214229 9214230 9214231 9214232 9214233 9214234 9214235 9214430 9214431 9214432 9214433 9214434 9214435 9214436 9214437 9214514 9214515 9214516 9214517 9214518 9214519 9214520 9214521 1030435 1030436 1030437 1030438 1030439 1030440 1030441 1030442 1030716 1030717 1030718 1030719 1030720 1030721 1030722 1030723 5264752 5264753 5264754 5264755 5264756 5264757 5264758 5264759 5265093 5265094 5265095 5265096 5265097 5265098 5265099 5265100 5265101 5621181 5621182 5621183 5621184 5621185 5621186 5621187 6891679 6891680 6891681 6891682 6891683 6891684 6891685 6891686 6891687 6891688 6891689 6891690 6891691 6891692 6891693 6891694 8104855 8104856 8104857 8104858 8104859 8104860 8104861 8104862 8104863 8104864 8104865 8104866 8104867 8104868 8104869 8104870 5227582 5227583 5227584 5227585 5227586 5227587 5227588 5227589 5227590 5227591 5227592 5227593 518818 518819 518820 518821 5375875 5375876 5375877 5375878 5375879 5375880 5375881 5375882 5403195 5403196 5403197 5403198 5403199 5403200 5403201 5403202 5403203 5403204 5403205 5403206 5403207 5403208 5403209 5403210 6064004 6064005 6064006 6064007 6064008 6064009 6064010 6064011 6179671 6179672 6179673 6179674 6179675 6179676 6179677 6179678 6315651 6315652 6315653 6315654 6315655 6315656 6315657 6315658 6705103 6705104 6705105 6705106 6705107 6705108 6705109 6705110 6705317 6705318 6705319 6705320 6705321 6705322 6705323 6705324 7744529 7744530 7744531 7744532 7744533 7744534 7744535 7744536 7745137 7745138 7745139 7745140 7745141 7745142 7745143 7745144 7903260 7903261 7903262 7903263 7903264 7903265 7903266 7903267 7968689 7968690 7968691 7968692 7968693 7968694 7968695 7968696 8113815 8113816 8113817 8113818 8113819 8113820 8113821 8113822 8539299 8539300 8539301 8539302 8539303 8539304 8539305 8539306 8572209 8572210 8572211 8572212 8572213 8572214 8572215 8572216 12760230 12760231 12760232 12760233 12760234 12760235 12760236 12760237 517148 517149 517150 517151 517152 517153 517154 517155 517367 517368 517369 517370 517371 517372 517373 517374 768822 768823 768824 768825 768826 768827 768828 768829 6071580 6071581 6071582 6071583 6071584 6071585 6071586 6071587 6072178 6072179 6072180 6072181 6072182 6072183 6072184 6072185 7001616 7001617 7001618 7001619 7001620 7001621 7001622 7001623 8400304 8400305 8400306 8400307 8400308 8400309 8400310 8400311 8400659 8400660 8400661 8400662 8400663 8400664 8400665 8400666 6210287 6210288 6210289 6210290 6210291 6210292 6210293 6210294 6212587 6212588 6212589 6212590 6212591 6212592 6212593 6212594 7567875 7567876 7567877 7567878 7567879 7567880 7567881 7567882 7531829 7531830 7531831 7531832 7531833 7531834 7531835 7531836 7531837 7531838 7531839 7531840 7531841 7531842 7531843 7531844 7531887 7531888 7531889 7531890 7531891 7531892 7531893 7531894 7206226 7206227 7206228 7206229 7206230 7206231 7206232 7206233 7206767 7206768 7206769 7206770 7206771 7206772 7206773 7206774 7206775 7206776 8049832 8049833 8049834 8049835 8049836 8049837 4987819 4987820 4987821 4987822 4987823 4987824 4987825 4987826 4988328 4988329 4988330 4988331 4988332 4988333 4988334 4988335 6074929 6074930 6074931 6074932 6074933 6074934 6074935 6074936 6075275 6075276 6075277 6075278 6075279 6075280 6075281 6075282 6075283 6075284 6075285 6075286 6075287 6075288 185018 185019 9087980 9087981 9087982 9087983 9087984 9087985 9087986 9087987 9088043 9088044 9088045 9088046 9088047 9088048 9088049 9088050 13112758 13112759 13112760 13112761 13112762 13112763 13112764 13112765 6744132 6744133 6744134 6744135 6744136 6744137 6744138 6744139 7639596 7639597 7639598 7639599 7639600 7639601 7639602 7639603 8715965 8715966 8715967 8715968 8715969 8715970 8715971 8715972 6073220 6073221 6073222 6073223 6073224 6073225 6073226 6073227 7208816 7208817 7208818 7208819 7208820 7208821 7208822 7208823 7208824 225944 225945 225946 225947 225948 225949 225950 9226706 9226707 9226708 9226709 9226710 9226711 9226712 9226713 istat for missing folder: ./istat /dev/sdb1 30211 MFT Entry Header Values: Entry: 30211 Sequence: 1 $LogFile Sequence Number: 16790486 Allocated Directory Links: 1 $STANDARD_INFORMATION Attribute Values: Flags: Archive Owner ID: 0 Created: Fri Dec 17 13:54:08 2004 File Modified: Fri Dec 17 13:54:08 2004 MFT Modified: Fri Dec 17 13:54:08 2004 Accessed: Tue Oct 28 14:18:01 2008 $FILE_NAME Attribute Values: Flags: Directory, Archive Name: UNIPROC Parent MFT Entry: 25442 Sequence: 1 Allocated Size: 0 Actual Size: 0 Created: Fri Dec 17 13:54:08 2004 File Modified: Fri Dec 17 13:54:08 2004 MFT Modified: Fri Dec 17 13:54:08 2004 Accessed: Fri Dec 17 13:54:08 2004 Attributes: Type: $STANDARD_INFORMATION (16-0) Name: N/A Resident size: 72 Type: $FILE_NAME (48-2) Name: N/A Resident size: 80 Type: $INDEX_ROOT (144-1) Name: $I30 Resident size: 680 ---------------------------------------------------------------------- >Comment By: Brian Carrier (carrier) Date: 2009-01-13 00:50 Message: The directory has two INDEX_ALLOCATION attributes... I don't know why. The missing file must be in the other attribute. The fix should be to process all INDEX_ALLOCATION attributes in ntfs_dir_open_meta(). ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2490550&group_id=55685 |
|
From: SourceForge.net <no...@so...> - 2009-01-13 05:29:22
|
Bugs item #2503552, was opened at 2009-01-13 00:23 Message generated for change (Comment added) made by carrier You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2503552&group_id=55685 Please note that this message will contain a full copy of the comment thread, including the initial issue submission, for this request, not just the latest update. Category: File System Tools Group: None >Status: Closed >Resolution: Fixed Priority: 5 Private: No Submitted By: Brian Carrier (carrier) Assigned to: Brian Carrier (carrier) Summary: Missing ISO9660 Files Initial Comment: In the attached ISO, files are missing from the root directory. Reported by Tom Black. ---------------------------------------------------------------------- >Comment By: Brian Carrier (carrier) Date: 2009-01-13 00:29 Message: Fixed in trunk and 3.0 branch. Bug was in code that processed hole at end of block. Fix was to force a stop at block boundaries. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2503552&group_id=55685 |
1 message has been excluded from this view by a project administrator.
