USN and fileID - do they indicate "physical" file position in disk?

[GoogleCodeExporter]

Hi Jean. This is more a question than a bug report - Hope this is the right 
place to ask.

When undeleting, files are named prepending their USN and fileID:
carver.py line 344: filename =  "%d_%d_%s" % (filerecord.fileID, first_usn, 
filename)

e.g.: OK_117446_872877_1.pdf

My question is: do either of these fields somehow indicate the physical 
position of the file in disk? (meaning: at the beginning, in the middle, at the 
end of the partition?)

Once again: thanks for your tools and your support!

Original issue reported on code.google.com by p...@lgomez.es on 11 Jul 2013 at 6:39

[GoogleCodeExporter]

Note that, in the above example about OK_117446_872877_1.pdf, the name of the 
original file before deletion was in fact:
1.pdf

Just in case someone was wondering :)

Original comment by p...@lgomez.es on 11 Jul 2013 at 6:41

• Added labels: ****
• Removed labels: ****

[GoogleCodeExporter]

no, these fields do not indicate the position on disk.
fileid: HFS file id, each file has its own, it is incremented each time a new 
file is created
usn: FTL update sequence number, it gives the "age" of a page on the nand flash.

at some point i will add more documentation on the wiki ;)

Original comment by jean.sig...@gmail.com on 15 Jul 2013 at 8:34

• Added labels: ****
• Removed labels: ****