sleuthkit
sleuthkit copied to clipboard
bodyfile: read mode not set for read-only FAT-32 file ?
0|/SUHDLOG.DAT|6|r/r--x--x--x|0|0|5166|1362870000|1362920466|0|0
istat -o 63 fuse/qcow1 6
Directory Entry: 6
Allocated
File Attributes: File, Read Only, Hidden
Size: 5166
Name: SUHDLOG.DAT
Directory Entry Times:
Written: 2013-03-10 14:01:06 (CET)
Accessed: 2013-03-10 00:00:00 (CET)
Created: 0000-00-00 00:00:00 (UTC)
Sectors:
339404 339405 339406 339407 339408 339409 339410 339411
339412 339413 339414 0 0 0 0 0
For comparison of a hidden only file
0|/BOOTLOG.TXT|4|r/rr-xr-xr-x|0|0|24602|1362870000|1362924256|0|0
istat -o 63 fuse/qcow1 4
Directory Entry: 4
Allocated
File Attributes: File, Hidden, Archive
Size: 24602
Name: BOOTLOG.TXT
Directory Entry Times:
Written: 2013-03-10 15:04:16 (CET)
Accessed: 2013-03-10 00:00:00 (CET)
Created: 0000-00-00 00:00:00 (UTC)
Sectors:
33484 33485 33486 33487 33488 33489 33490 33491
33492 33493 33494 33495 33496 33497 33498 33499
33852 33853 33854 33855 33856 33857 33858 33859
34164 34165 34166 34167 34168 34169 34170 34171
38148 38149 38150 38151 38152 38153 38154 38155
34020 34021 34022 34023 34024 34025 34026 34027
418652 0 0 0 0 0 0 0