analyzeMFT icon indicating copy to clipboard operation
analyzeMFT copied to clipboard

Incorrect file sizes reported

Open hiddenillusion opened this issue 11 years ago • 0 comments

Defined in "decodeFNAttribute()", the value for the file size derives from "d['real_fsize'] = struct.unpack("<q",s[48:56])[0]" .

If I add "int(record['fn',0]['real_fsize'])" to the output of (e.g., as seen in "mft_to_body()"), the resulting file sizes reported are incorrect. I've validated the file sizes show up correct in two other tools.

hiddenillusion avatar Oct 02 '14 13:10 hiddenillusion