| layout | default | ||
|---|---|---|---|
| title | Error Messages | ||
| categories |
|
||
| redirect_from |
|
||
| last_modified | 2015-03-07 |
This page contains some error messages that could be encountered when running TSK and Autopsy.
Error extracting file from image (ntfs_uncompress_compunit: Phrase token offset is too large: 1 (max: 0))
This message occurs when trying to process a compressed NTFS file that is corrupt. This can occur when a file has been deleted and the clusters have been reallocated to another file.
# blkls -f ntfs -i raw -a /dev/sde1 > /tmp/allocatedspace.dump
Error in metadata structure (dinode_lookup: More Update Sequence Entries than MFT size)
This message can occur when trying to view allocated data on an NTFS filesystem damaged by unplugging a USB drive while it was writing. This file system is not recognized/fixable by chkdsk either, and needs some reconstruction before chkdsk will work.