Re: Large file support in TASK

From: KEVEN M MURPHY <murphyk(at)gdls.com>
Date: Mon Nov 18 2002 - 14:35:58 EST

Geoffrey,

This is pretty much what I have recently found out with a WinXP 30 gig image. I was able to see all of the files by installing the NTFS driver from NTFS driver project found at http://linux-ntfs.sourceforge.net. I am not sure if gentoo uses this driver or not. The Redhat kernel still uses the old one.

However, I still cannot recover any files. I remember the last time I installed Task there were a bunch of filesystem files. I am not sure if Brian has updated Task to support NTFS 3.0.

> /usr/local/task/bin/fls: entry 29286 has an invalid MFT magic: 88000000
I have been receiving similar errors using Task when clicking on deleted files. Also, I can recover file using Task.

In order to recover any files I had to load up vmware running Windows 2000 and use Restorer2000 on the dd image.

Keven Murphy
GCIA & GCFA
murphyk@gdls.com

---

This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com Received on Mon Nov 18 22:47:36 2002