NTFS inode ouput from ls -i

Harry G McGavran Jr w5pny@w5pny.com
Tue Jul 18 03:34:00 GMT 2017

I just had to deal with the output from chkdsk on my Windows 7 pro
that lists MFT record numbers just like ifind and icat do
in the Sleuth Kit as summarized in:


The chkdsk MFT record numbers are exactly what ifind and icat
display/use. I also discovered when doing "ls -i" on NTFS
file systems mounted on my Ubuntu 16.04 linux system that
the "ls -i" numbers reported are the same as the chkdsk, ifind, and icat
record numbers.  These are all the lower 32 bits of the 64 bit
numbers reported by "ls -i" with the current cygwin.  Had
the cygwin "find -inum" and "ls -i" used these 32 bit numbers,
my task would have been easier.  From the above link, Corinna
found it odd that ifind and icat would use the 32 bit numbers.
I would have preferred them when dealing with chkdsk issues.

What's the current thinking about this?


Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

More information about the Cygwin mailing list