iphone-dataprotection icon indicating copy to clipboard operation
iphone-dataprotection copied to clipboard

USN and fileID - do they indicate "physical" file position in disk?

Open GoogleCodeExporter opened this issue 9 years ago • 2 comments

Hi Jean. This is more a question than a bug report - Hope this is the right 
place to ask.

When undeleting, files are named prepending their USN and fileID:
carver.py line 344: filename =  "%d_%d_%s" % (filerecord.fileID, first_usn, 
filename)

e.g.: OK_117446_872877_1.pdf

My question is: do either of these fields somehow indicate the physical 
position of the file in disk? (meaning: at the beginning, in the middle, at the 
end of the partition?)

Once again: thanks for your tools and your support!

Original issue reported on code.google.com by [email protected] on 11 Jul 2013 at 6:39

GoogleCodeExporter avatar Mar 19 '15 02:03 GoogleCodeExporter

Note that, in the above example about OK_117446_872877_1.pdf, the name of the 
original file before deletion was in fact:
1.pdf

Just in case someone was wondering :)

Original comment by [email protected] on 11 Jul 2013 at 6:41

GoogleCodeExporter avatar Mar 19 '15 02:03 GoogleCodeExporter

no, these fields do not indicate the position on disk.
fileid: HFS file id, each file has its own, it is incremented each time a new 
file is created
usn: FTL update sequence number, it gives the "age" of a page on the nand flash.

at some point i will add more documentation on the wiki ;)

Original comment by [email protected] on 15 Jul 2013 at 8:34

GoogleCodeExporter avatar Mar 19 '15 02:03 GoogleCodeExporter