NTFS inode ouput from ls -i
- Date: Mon, 17 Jul 2017 11:44:39 -0600
- From: Harry G McGavran Jr <w5pny@xxxxxxxxx>
- Subject: NTFS inode ouput from ls -i
I just had to deal with the output from chkdsk on my Windows 7 pro
that lists MFT record numbers just like ifind and icat do
in the Sleuth Kit as summarized in:
The chkdsk MFT record numbers are exactly what ifind and icat
display/use. I also discovered when doing "ls -i" on NTFS
file systems mounted on my Ubuntu 16.04 linux system that
the "ls -i" numbers reported are the same as the chkdsk, ifind, and icat
record numbers. These are all the lower 32 bits of the 64 bit
numbers reported by "ls -i" with the current cygwin. Had
the cygwin "find -inum" and "ls -i" used these 32 bit numbers,
my task would have been easier. From the above link, Corinna
found it odd that ifind and icat would use the 32 bit numbers.
I would have preferred them when dealing with chkdsk issues.
What's the current thinking about this?
Problem reports: http://cygwin.com/problems.html
Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple