From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 118817 invoked by alias); 17 Jul 2017 17:46:04 -0000 Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner@cygwin.com Mail-Followup-To: cygwin@cygwin.com Received: (qmail 118388 invoked by uid 89); 17 Jul 2017 17:45:18 -0000 Authentication-Results: sourceware.org; auth=none X-Virus-Found: No X-Spam-SWARE-Status: No, score=-0.9 required=5.0 tests=BAYES_00,KAM_LAZY_DOMAIN_SECURITY,RCVD_IN_DNSWL_NONE autolearn=no version=3.3.2 spammy=Kit, Hx-languages-length:909, summarized X-HELO: p3plsmtpa07-09.prod.phx3.secureserver.net Received: from p3plsmtpa07-09.prod.phx3.secureserver.net (HELO p3plsmtpa07-09.prod.phx3.secureserver.net) (173.201.192.238) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with ESMTP; Mon, 17 Jul 2017 17:45:13 +0000 Received: from localhost.localdomain ([174.56.100.62]) by :SMTPAUTH: with SMTP id XA4VdkxNS1XDCXA4WdnYJ0; Mon, 17 Jul 2017 10:44:40 -0700 Received: from [127.0.0.1] (localhost.localdomain [127.0.0.1]) by localhost.localdomain (Postfix) with ESMTP id C21463434DB for ; Mon, 17 Jul 2017 11:44:39 -0600 (MDT) Reply-To: w5pny@w5pny.com To: cygwin@cygwin.com From: Harry G McGavran Jr Subject: NTFS inode ouput from ls -i Message-ID: <77d1bb70-5bce-0ac0-e011-1997f7db8a25@w5pny.com> Date: Tue, 18 Jul 2017 03:34:00 -0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.2.1 MIME-Version: 1.0 Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit X-CMAE-Envelope: MS4wfL4MYIdMgvI61WZXf6tBEZZ0Kij26FmK/jJvjrV7wSCnuJGk/bgMrdEAqtwiS5L9W9zA9uw1IlTisJBYLT5ZPznqCYjrKuACB7ZInA8vnedYaFugQ2yT M1A8FkM90RwxLAFxsaAGL1bMcxTC8oXIV7XBUaUDyZKKX04c1yP6q3z9 X-SW-Source: 2017-07/txt/msg00259.txt.bz2 I just had to deal with the output from chkdsk on my Windows 7 pro that lists MFT record numbers just like ifind and icat do in the Sleuth Kit as summarized in: https://cygwin.com/ml/cygwin/2012-11/msg00172.html The chkdsk MFT record numbers are exactly what ifind and icat display/use. I also discovered when doing "ls -i" on NTFS file systems mounted on my Ubuntu 16.04 linux system that the "ls -i" numbers reported are the same as the chkdsk, ifind, and icat record numbers. These are all the lower 32 bits of the 64 bit numbers reported by "ls -i" with the current cygwin. Had the cygwin "find -inum" and "ls -i" used these 32 bit numbers, my task would have been easier. From the above link, Corinna found it odd that ifind and icat would use the 32 bit numbers. I would have preferred them when dealing with chkdsk issues. What's the current thinking about this? Harry -- Problem reports: http://cygwin.com/problems.html FAQ: http://cygwin.com/faq/ Documentation: http://cygwin.com/docs.html Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple