New blog post - Contiguous and fragmented

Some of you may have seen this NTFS oddity before - I hadn't…

http//sandersonforensics.com/forum/entry.php?16-Contiguous-and-fragmented!

Nice ) .
If you can, it would be interesting to run on the mounted filesystem this tool here
http//www.wd-3.com/archive/luserland.htm
and check what it "sees".

jaclaz

Nice ) .
If you can, it would be interesting to run on the mounted filesystem this tool here
http//www.wd-3.com/archive/luserland.htm
and check what it "sees".

jaclaz

Thanks

Why would running that be interesting? AFAICS from a quick read it simply lists the LBA's of the file, or a given offset within a file - given that the file cluster/sector run is contiguous I already know that!

Has the file been compressed or uncompressed at some time.

(It would be nice if the DOS program displayed data in Hex - much easier to understand at this level - and would match a MFT sector directly)

I would be very surprised if it had been previously compressed. File was in subdir of program data folder I. A friends computer (very non techy home user). Gut feeling is that this may not be that rare but need to modify my code to test this on a complete image - prob later in the week as away from desk for a few days.

Why would running that be interesting? AFAICS from a quick read it simply lists the LBA's of the file, or a given offset within a file - given that the file cluster/sector run is contiguous I already know that!

It may list the file in either a "big" contiguous set of addresses or in three sets of addresses (that are contiguous).

jaclaz

Why would running that be interesting? AFAICS from a quick read it simply lists the LBA's of the file, or a given offset within a file - given that the file cluster/sector run is contiguous I already know that!

It may list the file in either a "big" contiguous set of addresses or in three sets of addresses (that are contiguous).

jaclaz

I'm sorry jaclaz you have lost me,

I'm sorry jaclaz you have lost me,

It's just an idea ? , I'll show you the output of the thingy for a "normal" fragmented file and for a "normal" contiguous one
C\dummy>MyFragmenter.exe -p 3 test3.rnd
MyFragmenter v1.2, 2008 J.C. Kessels

C\dummy>getFileExtents.exe test3.rnd
File offset 0 LBA 1f63cbc7 Sectors 2a0
File offset 54000 LBA e2b4da7 Sectors 2a0
File offset a8000 LBA f719617 Sectors 290And, once made contiguous with Contig
C\dummy>contig -v -a test3.rnd

C\dummy>getFileExtents.exe test3.rnd
File offset 0 LBA 1aec112f Sectors 7d0
In the first example, the programs lists three (non-contiguous) addresses.
In the second (obviously) it lists a single contiguous address.

What I was curious about was if applied to your "queer" file it would list three addresses (second immediately following the first and third immediately following the second) or a single address (as IF the file was a "normal" contiguous file).

jaclaz

Ah I see - you are wondering whether this program will show both the fragmented and contiguous nature of this file, essentially you are asking me to to test the program for you as I have access to a fragmented/contiguous file.

Ah I see - you are wondering whether this program will show both the fragmented and contiguous nature of this file, essentially you are asking me to to test the program for you as I have access to a fragmented/contiguous file.

… and because I have no idea oops on how I could possibly replicate a "queer" situation like the one you already have for that particular file…

jaclaz