iphone-dataprotection
iphone-dataprotection copied to clipboard
USN and fileID - do they indicate "physical" file position in disk?
Hi Jean. This is more a question than a bug report - Hope this is the right
place to ask.
When undeleting, files are named prepending their USN and fileID:
carver.py line 344: filename = "%d_%d_%s" % (filerecord.fileID, first_usn,
filename)
e.g.: OK_117446_872877_1.pdf
My question is: do either of these fields somehow indicate the physical
position of the file in disk? (meaning: at the beginning, in the middle, at the
end of the partition?)
Once again: thanks for your tools and your support!
Original issue reported on code.google.com by [email protected]
on 11 Jul 2013 at 6:39
Note that, in the above example about OK_117446_872877_1.pdf, the name of the
original file before deletion was in fact:
1.pdf
Just in case someone was wondering :)
Original comment by [email protected]
on 11 Jul 2013 at 6:41
no, these fields do not indicate the position on disk.
fileid: HFS file id, each file has its own, it is incremented each time a new
file is created
usn: FTL update sequence number, it gives the "age" of a page on the nand flash.
at some point i will add more documentation on the wiki ;)
Original comment by [email protected]
on 15 Jul 2013 at 8:34