Difference between revisions of "Error Messages"

From SleuthKitWiki
Jump to: navigation, search
(Added token offset error.)
 
(Added an error message: More Update Sequence Entries than MFT size (ntfs))
 
(2 intermediate revisions by one user not shown)
Line 1: Line 1:
This page contains some error messages that could be encountered when running TSK and Autopsy.  
+
This page contains some error messages that could be encountered when running [[TSK]] and [[Autopsy]].  
  
 
<hr>
 
<hr>
Line 6: Line 6:
 
</pre>
 
</pre>
  
This message occurs when trying to process a compressed NTFS file that is corrupt.  This can occur when a file has been deleted and the clusters have been reallocated to another file.  
+
This message occurs when trying to process a compressed [[NTFS]] file that is corrupt.  This can occur when a file has been deleted and the clusters have been reallocated to another file.
 +
 
 +
<hr>
 +
 
 +
<pre>
 +
# blkls -f ntfs -i raw -a /dev/sde1 > /tmp/allocatedspace.dump
 +
Error in metadata structure (dinode_lookup: More Update Sequence Entries than MFT size)
 +
</pre>
 +
 
 +
This message can occur when trying to view allocated data on an NTFS filesystem damaged by unplugging a USB drive while it was writing.  This file system is not recognized/fixable by chkdsk either, and needs some reconstruction before chkdsk will work.
  
 
<hr>
 
<hr>

Latest revision as of 10:59, 7 March 2015

This page contains some error messages that could be encountered when running TSK and Autopsy.


Error extracting file from image (ntfs_uncompress_compunit: Phrase token offset is too large:  1 (max: 0))

This message occurs when trying to process a compressed NTFS file that is corrupt. This can occur when a file has been deleted and the clusters have been reallocated to another file.


# blkls -f ntfs -i raw -a /dev/sde1 > /tmp/allocatedspace.dump
Error in metadata structure (dinode_lookup: More Update Sequence Entries than MFT size)

This message can occur when trying to view allocated data on an NTFS filesystem damaged by unplugging a USB drive while it was writing. This file system is not recognized/fixable by chkdsk either, and needs some reconstruction before chkdsk will work.