Couple of bugs on TestDisk 7.0 OSX

Using TestDisk to undelete files
Post Reply
Message
Author
juanii
Posts: 1
Joined: 20 May 2015, 18:15

Couple of bugs on TestDisk 7.0 OSX

#1 Post by juanii » 20 May 2015, 18:39

Hello,

First of all I'd like to thank all the people involved in TestDisk for making such a great tool. I'm currently using version 7.0 in OS X 10.10 it to recover some deleted files from an NTFS partition and found a couple of things that might be worth reporting.

While copying the deleted files, I noticed some apparently zero bytes files (in the deleted list) were taking too long. And then I found these files weren't actually zero bytes long, but some huge deleted 200GB disk image files. Is it possible that these huge files are overflowing the variables where you store the file size information to show on the deleted files list? I'm not sure if it's just a coincidence but all these files were missing the timestamp. I ran out of disk space and had to cancel the copy for the other files with zero bytes and missing timestamps.

The other thing is about file timestamps. I found some files dated Dec 31 1969 21:17. Given I'm in UTC-3, this seems like a time_t variable with a value around 1000 converted to a date string without correcting for the time zone offset. I really don't care about timestamps as long as I'm able to recover the file contents, but someone using this tool for forensic analysis may find this important.

Again, thanks a lot for publishing this useful piece of software.

Regards

Sponsored links

Post Reply

Who is online

Users browsing this forum: No registered users and 1 guest