sleuthkit-users

[chris <ch...@cc...>]

Hi there, 

I have noticed a minor quirk using istat, that only effects small 
files on ntfs volumes, as far as I am aware:

When istating an inode of a small file (under one block not sure if this is 
disk sectors or fs blocks) no blocks are displayed in the output. I am using 
v1.65. 

I have attached the output of istat for two files in the root directory of an 
ntfs volume, istat-a is the problematic small file and istat-b is a larger 
file which works fine.  

Regards

Chris Barbour