On Mon, 2005-03-14 at 06:47, H Carvey wrote:
> When booting a Windows XP system with a Linux distro, one mounts the NTFS drive and runs a command such as "ls -li". In the output, what does the inode number refer to in the NTFS structure?
>
> Thanks,
>
> H. Carvey
> "Windows Forensics and Incident Recovery"
Please review the vfs.txt file if you're unsure what the inode number
refers to. The NTFS source (Linux) also documents this in detail - much
too much to copy and paste here.
regards,
farmerdude
www.crazytrain.com
-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com
> When booting a Windows XP system with a Linux distro, one mounts the NTFS drive and runs a command such as "ls -li". In the output, what does the inode number refer to in the NTFS structure?
>
> Thanks,
>
> H. Carvey
> "Windows Forensics and Incident Recovery"
Please review the vfs.txt file if you're unsure what the inode number
refers to. The NTFS source (Linux) also documents this in detail - much
too much to copy and paste here.
regards,
farmerdude
www.crazytrain.com
-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com
[ reply ]