Defined in "decodeFNAttribute()", the value for the file size derives from
"d['real_fsize'] = struct.unpack("<q",s[48:56])[0]" .
If I add "int(record['fn',0]['real_fsize'])" to the output of (e.g., as seen in "mft_to_body()"), the resulting file sizes reported are incorrect. I've validated the file sizes show up correct in two other tools.
Defined in "decodeFNAttribute()", the value for the file size derives from "d['real_fsize'] = struct.unpack("<q",s[48:56])[0]" .
If I add "int(record['fn',0]['real_fsize'])" to the output of (e.g., as seen in "mft_to_body()"), the resulting file sizes reported are incorrect. I've validated the file sizes show up correct in two other tools.