You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
In the raw image attached (fs.img in the zip file), the file xazjlgis/ldniruft/yqntnnnb/lkrabebi/lykvvzey has been renamed to xazjlgis/ldniruft/xyalaefy/cfipubey/blpytzyw (sorry for the file names). However, lykvvzey is still reported as allocated by fls.
I think the problem here is that TSK parses the index entries which are not part of the active tree without checking the $BITMAP attribute. While finding the index entries in the unused space is definitely desired, the found entries should be cross-checked to have their correct state. As a first quick fix (which is obviously not a complete fix), I added a patch to the zip file, which basically adds the following code to ntfs_proc_idxentry:
fs_attr_bmap = tsk_fs_attrlist_get(a_fs_dir->fs_file->meta->attr, TSK_FS_ATTR_TYPE_NTFS_BITMAP);
if (fs_attr_bmap) {
if (fs_attr_bmap->flags & TSK_FS_ATTR_RES) {
// The following check works only when the $BITMAP attribute has no bits set.
// This is obviously not the correct way to do this...
if (*(fs_attr_bmap->rd.buf) == 0) {
fs_name->flags = TSK_FS_NAME_FLAG_UNALLOC;
}
}
else if (fs_attr_bmap->flags & TSK_FS_ATTR_NONRES) {
// TODO: implement this for non-resident $BITMAP attributes
}
}
I'm still trying to create test images for the cases not implemented in the code above, but after applying the patch, the fls output looks okay to me:
In the raw image attached (
fs.imgin the zip file), the filexazjlgis/ldniruft/yqntnnnb/lkrabebi/lykvvzeyhas been renamed toxazjlgis/ldniruft/xyalaefy/cfipubey/blpytzyw(sorry for the file names). However,lykvvzeyis still reported as allocated byfls.Calling
istatwith the metadata address83-128shows the correct new file name:If we grep for the address 83-128 as well as the corresponding parent directory addresses, we get both, the old and the new paths:
Looking at the directories, we can see that the $INDEX_ALLOCATION attribute of directory
71still has entries for the old file name:The $BITMAP attribute is completely zero:
I think the problem here is that TSK parses the index entries which are not part of the active tree without checking the $BITMAP attribute. While finding the index entries in the unused space is definitely desired, the found entries should be cross-checked to have their correct state. As a first quick fix (which is obviously not a complete fix), I added a patch to the zip file, which basically adds the following code to
ntfs_proc_idxentry:I'm still trying to create test images for the cases not implemented in the code above, but after applying the patch, the fls output looks okay to me:
ntfs-moved-file-state-issue.zip
The text was updated successfully, but these errors were encountered: