Couple of bugs on TestDisk 7.0 OSX

Using TestDisk to undelete files
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
juanii
Posts: 1
Joined: 20 May 2015, 18:15

Couple of bugs on TestDisk 7.0 OSX

#1 Post by juanii »

Hello,

First of all I'd like to thank all the people involved in TestDisk for making such a great tool. I'm currently using version 7.0 in OS X 10.10 it to recover some deleted files from an NTFS partition and found a couple of things that might be worth reporting.

While copying the deleted files, I noticed some apparently zero bytes files (in the deleted list) were taking too long. And then I found these files weren't actually zero bytes long, but some huge deleted 200GB disk image files. Is it possible that these huge files are overflowing the variables where you store the file size information to show on the deleted files list? I'm not sure if it's just a coincidence but all these files were missing the timestamp. I ran out of disk space and had to cancel the copy for the other files with zero bytes and missing timestamps.

The other thing is about file timestamps. I found some files dated Dec 31 1969 21:17. Given I'm in UTC-3, this seems like a time_t variable with a value around 1000 converted to a date string without correcting for the time zone offset. I really don't care about timestamps as long as I'm able to recover the file contents, but someone using this tool for forensic analysis may find this important.

Again, thanks a lot for publishing this useful piece of software.

Regards

Locked