The Allocation List button can also be used to view the allocation status of metadata structures in groups of 500.
The File Type is given, which is the output of the 'file' tool. This tool uses any header information in the file to guess what its type is. The MD5 value of the file is also given.
If Autopsy has been configured to use hash databases, then one can select which databases to look for the file in. See Hash Databases for more details.
The rest of the information will vary depending on the file system type. In general, the allocation status will be given as well as the size and each data unit that it has allocated. A link will exist for each data unit that will show its contents.
The Report option generates an ASCII report with the structure details, MD5 values, and dates in it. The View Contents option displays the allocated data contents as one large file. The Export option allows one to save the data contents to a file. The Add Note button allows one to add a comment about this structure so that it can be later recalled.
NTFS is a much different design than UNIX file systems and the meta data structures are addressed differently. They typically have the form of A-B-C, 88-128-3 for example. The A value is the address of the file in the Master File Table, 88 for example. This is similar to the inode value in UNIX. Each file has several attributes, including at least one in files for the data. The B value is the type of attribute. In most cases, the data attribute has a type of 128 so this is commonly seen. But, if you want to see the file name attribute, you could specify that type and see the contents if you like (it is fairly boring). The final value, C, is the id. Every attribute has a unique id value. So, if there are multiple attributes with the same type, you can specify the type.
FAT does not give addresses to the directory entry structures. in FAT, directory entries can be stored anywhere on the disk. They are stored in the clusters allocated to the parent directory. This is unlike NTFS or UNIX where the structures are in a large table that does not move. get around that,
The addressing issue was solved by providing an address to every 32-byte area in the Data Area. Whether that data was currently a directory entry or not. This makes it easy to find a given address and scale when new files are created. The downside is that not every address is possible, so it is likely that you will see jumps in the address values. See the documentation in The Sleuth Kit for more details.