Getting the list of blocks for a file

Tool requests, development, and troubleshooting topics related to TSK.

Moderator: carrier

Getting the list of blocks for a file

Postby eg97477 » Thu Apr 13, 2017 12:40 pm

This should be a fairly easy question to answer, but one I am having trouble finding on my own.

I can open and read a file from the file system using tsk_fs_file_open & tsk_fs_file_read easily enough and can confirm that it will return the expected data, but I would like to be able obtain the list of blocks related to the file. I can see that autopsy is able to get this list in the section titled "Data Fork Blocks," but I am not certain how that information is being obtained.

Thank you.
eg97477
 
Posts: 1
Joined: Tue Apr 11, 2017 12:38 pm

Return to The Sleuth Kit (TSK)

Who is online

Users browsing this forum: No registered users and 2 guests

cron