I just had to deal with the output from chkdsk on my Windows 7 pro that lists MFT record numbers just like ifind and icat do in the Sleuth Kit as summarized in:
https://cygwin.com/ml/cygwin/2012-11/msg00172.html The chkdsk MFT record numbers are exactly what ifind and icat display/use. I also discovered when doing "ls -i" on NTFS file systems mounted on my Ubuntu 16.04 linux system that the "ls -i" numbers reported are the same as the chkdsk, ifind, and icat record numbers. These are all the lower 32 bits of the 64 bit numbers reported by "ls -i" with the current cygwin. Had the cygwin "find -inum" and "ls -i" used these 32 bit numbers, my task would have been easier. From the above link, Corinna found it odd that ifind and icat would use the 32 bit numbers. I would have preferred them when dealing with chkdsk issues. What's the current thinking about this? Harry -- Problem reports: http://cygwin.com/problems.html FAQ: http://cygwin.com/faq/ Documentation: http://cygwin.com/docs.html Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple
