sleuthkit-users

[sleuthkit-users] fsstat: Incorrect update sequence value in MFT entry

[Bergander Hans-P. (D. * <Han...@de...>]

I am trying my first steps with TSK - unfortunately I rather quickly =
faced a problem. Looking up the manuals and the web didn't give me an =
answer - hope me question is not too silly.

I have a dd image of /dev/hda1 with ntfs on it. md5's are ok.

Running 'fsstat -v -f ntfs hda1.dd' fails, however, mounting the =
dd-image as ntfs using a loop device works fine.

Here is the output of fsstat:
    ntfs_mft_lookup: Processing MFT 0
    fs_read_random: read offs 2595328 len 1024 (mft read)
    fsstat: Incorrect update sequence value in MFT entry
    Update Value: 0x0 Actual Value: 0x3db Replacement Value: 0x0
    This is typically because of a corrupted entry

I am using TSK ver 1.72 on Debian sarge.

What can I do? Any help would be appriciated.

Thanks
Peter B.

[sleuthkit-users] fsstat: Incorrect update sequence value in MFT entry

[Joerg F. <Joe...@un...>]

Hi,

I encountered the same problem as Hans-Peter:
see:
http://sourceforge.net/mailarchive/forum.php?thread_id=3D5697461&forum_id=
=3D10358

root@hitchhiker:/mnt# fsstat -v -f ntfs disk.p1.dd
ntfs_mft_lookup: Processing MFT 0
fs_read_random: read offs 65536 len 1024 (mft read)
fsstat: Incorrect update sequence value in MFT entry
Update Value: 0x0 Actual Value: 0x993 Replacement Value: 0x0
This is typically because of a corrupted entry
root@hitchhiker:/mnt# fsstat -v -f ntfs disk.p2.dd
ntfs_mft_lookup: Processing MFT 0
fs_read_random: read offs 8192 len 1024 (mft read)
fsstat: Incorrect update sequence value in MFT entry
Update Value: 0x0 Actual Value: 0x28 Replacement Value: 0x0
This is typically because of a corrupted entry
root@hitchhiker:/mnt# fsstat -v -f ntfs disk.p3.dd
ntfs_mft_lookup: Processing MFT 0
fs_read_random: read offs 16384 len 1024 (mft read)
fsstat: Incorrect update sequence value in MFT entry
Update Value: 0x0 Actual Value: 0x23 Replacement Value: 0x0
This is typically because of a corrupted entry


I attached the MFTs. Hope this helps debugging this problem

btw: I also use Debian Sarge, sleuthkit 1.72.

I created a hd-image with dd and splitted the three partitions.
with the help of mmls.

maybe you need also this info:
root@hitchhiker:/mnt# file disk.*
disk.dd:    x86 boot sector

disk.p1.dd: x86 boot sector, code offset 0x52, OEM-ID "NTFS    ",
sectors/cluster 8, reserved sectors 0, Media descriptor 0xf8, heads 255,
hidden sectors 63, dos < 4.0 BootSector (0x80)

disk.p2.dd: x86 boot sector, code offset 0x52, OEM-ID "NTFS    ",
reserved sectors 0, Media descriptor 0xf8, heads 255, hidden sectors 63,
dos < 4.0 BootSector (0x80)

disk.p3.dd: x86 boot sector, code offset 0x52, OEM-ID "NTFS    ",
sectors/cluster 2, reserved sectors 0, Media descriptor 0xf8, heads 255,
hidden sectors 63, dos < 4.0 BootSector (0x80)


--=20
J=F6rg Friedrich

There are only 10 types of people:
Those who understand binary and those who don't.

Re: [sleuthkit-users] fsstat: Incorrect update sequence value in MFT entry

[Brian C. <ca...@sl...>]

On Oct 12, 2004, at 6:53 AM, Joerg Friedrich wrote:

> Hi,
>
> I encountered the same problem as Hans-Peter:
> see:
> http://sourceforge.net/mailarchive/forum.php? 
> thread_id=5697461&forum_id=10358


> btw: I also use Debian Sarge, sleuthkit 1.72.

There seems to be an issue with Debian Sarge and some pointers in TSK.   
(it prefers (uintptr_t over only (int)).  I'll send you the latest  
version to see if it helps.

brian

Re: [sleuthkit-users] fsstat: Incorrect update sequence value in MFT entry

[Brian C. <ca...@sl...>]

Can you send me the data from running the following:

dd if=IMG.dd bs=512 skip=5069 count=2 of=mft.dat

This is the MFT that has the bad update values.

brian

On Oct 4, 2004, at 3:04 AM, Bergander Hans-Peter (DSB) * wrote:

> I am trying my first steps with TSK - unfortunately I rather quickly 
> faced a problem. Looking up the manuals and the web didn't give me an 
> answer - hope me question is not too silly.
>
> I have a dd image of /dev/hda1 with ntfs on it. md5's are ok.
>
> Running 'fsstat -v -f ntfs hda1.dd' fails, however, mounting the 
> dd-image as ntfs using a loop device works fine.
>
> Here is the output of fsstat:
>     ntfs_mft_lookup: Processing MFT 0
>     fs_read_random: read offs 2595328 len 1024 (mft read)
>     fsstat: Incorrect update sequence value in MFT entry
>     Update Value: 0x0 Actual Value: 0x3db Replacement Value: 0x0
>     This is typically because of a corrupted entry
>
> I am using TSK ver 1.72 on Debian sarge.
>
> What can I do? Any help would be appriciated.