Difference between revisions of "Error Messages"
From SleuthKitWiki
m (Added back references.) |
(Added an error message: More Update Sequence Entries than MFT size (ntfs)) |
||
Line 7: | Line 7: | ||
This message occurs when trying to process a compressed [[NTFS]] file that is corrupt. This can occur when a file has been deleted and the clusters have been reallocated to another file. | This message occurs when trying to process a compressed [[NTFS]] file that is corrupt. This can occur when a file has been deleted and the clusters have been reallocated to another file. | ||
+ | |||
+ | <hr> | ||
+ | |||
+ | <pre> | ||
+ | # blkls -f ntfs -i raw -a /dev/sde1 > /tmp/allocatedspace.dump | ||
+ | Error in metadata structure (dinode_lookup: More Update Sequence Entries than MFT size) | ||
+ | </pre> | ||
+ | |||
+ | This message can occur when trying to view allocated data on an NTFS filesystem damaged by unplugging a USB drive while it was writing. This file system is not recognized/fixable by chkdsk either, and needs some reconstruction before chkdsk will work. | ||
<hr> | <hr> |
Latest revision as of 11:59, 7 March 2015
This page contains some error messages that could be encountered when running TSK and Autopsy.
Error extracting file from image (ntfs_uncompress_compunit: Phrase token offset is too large: 1 (max: 0))
This message occurs when trying to process a compressed NTFS file that is corrupt. This can occur when a file has been deleted and the clusters have been reallocated to another file.
# blkls -f ntfs -i raw -a /dev/sde1 > /tmp/allocatedspace.dump Error in metadata structure (dinode_lookup: More Update Sequence Entries than MFT size)
This message can occur when trying to view allocated data on an NTFS filesystem damaged by unplugging a USB drive while it was writing. This file system is not recognized/fixable by chkdsk either, and needs some reconstruction before chkdsk will work.