Couple of bugs on TestDisk 7.0 OSX
Posted: 20 May 2015, 18:39
Hello,
First of all I'd like to thank all the people involved in TestDisk for making such a great tool. I'm currently using version 7.0 in OS X 10.10 it to recover some deleted files from an NTFS partition and found a couple of things that might be worth reporting.
While copying the deleted files, I noticed some apparently zero bytes files (in the deleted list) were taking too long. And then I found these files weren't actually zero bytes long, but some huge deleted 200GB disk image files. Is it possible that these huge files are overflowing the variables where you store the file size information to show on the deleted files list? I'm not sure if it's just a coincidence but all these files were missing the timestamp. I ran out of disk space and had to cancel the copy for the other files with zero bytes and missing timestamps.
The other thing is about file timestamps. I found some files dated Dec 31 1969 21:17. Given I'm in UTC-3, this seems like a time_t variable with a value around 1000 converted to a date string without correcting for the time zone offset. I really don't care about timestamps as long as I'm able to recover the file contents, but someone using this tool for forensic analysis may find this important.
Again, thanks a lot for publishing this useful piece of software.
Regards
First of all I'd like to thank all the people involved in TestDisk for making such a great tool. I'm currently using version 7.0 in OS X 10.10 it to recover some deleted files from an NTFS partition and found a couple of things that might be worth reporting.
While copying the deleted files, I noticed some apparently zero bytes files (in the deleted list) were taking too long. And then I found these files weren't actually zero bytes long, but some huge deleted 200GB disk image files. Is it possible that these huge files are overflowing the variables where you store the file size information to show on the deleted files list? I'm not sure if it's just a coincidence but all these files were missing the timestamp. I ran out of disk space and had to cancel the copy for the other files with zero bytes and missing timestamps.
The other thing is about file timestamps. I found some files dated Dec 31 1969 21:17. Given I'm in UTC-3, this seems like a time_t variable with a value around 1000 converted to a date string without correcting for the time zone offset. I really don't care about timestamps as long as I'm able to recover the file contents, but someone using this tool for forensic analysis may find this important.
Again, thanks a lot for publishing this useful piece of software.
Regards