analyzeMFT
analyzeMFT copied to clipboard
Incorrect file sizes reported
Defined in "decodeFNAttribute()", the value for the file size derives from "d['real_fsize'] = struct.unpack("<q",s[48:56])[0]" .
If I add "int(record['fn',0]['real_fsize'])" to the output of (e.g., as seen in "mft_to_body()"), the resulting file sizes reported are incorrect. I've validated the file sizes show up correct in two other tools.