Tool requests, development, and troubleshooting topics related to TSK.
This should be a fairly easy question to answer, but one I am having trouble finding on my own.
I can open and read a file from the file system using tsk_fs_file_open & tsk_fs_file_read easily enough and can confirm that it will return the expected data, but I would like to be able obtain the list of blocks related to the file. I can see that autopsy is able to get this list in the section titled "Data Fork Blocks," but I am not certain how that information is being obtained.
- Posts: 1
- Joined: Tue Apr 11, 2017 12:38 pm
Return to The Sleuth Kit (TSK)
Who is online
Users browsing this forum: No registered users and 2 guests