tsk_fs_file_read gives wrong content for deleted file

Tool requests, development, and troubleshooting topics related to TSK.

Moderator: carrier

tsk_fs_file_read gives wrong content for deleted file

Postby anu » Mon Nov 30, 2015 11:15 am

Hi, I am a developer and a newbie to Sleuthkit. Recently I developed a C++ program to read the contents of files from my disk using sleuthkit. I used the function 'tsk_fs_file_read()'. I was able to read the contents of deleted files also using the API. But I failed once: I created a text file and added some content to it. Later I deleted it and created a new text file with the same file name and a different content with shorter size. Now when I try to read the files, the deleted file displays the content of the new file followed by zeros. The size of deleted file is shown correctly. How can I get the actual content of the deleted file.. Thanks for your help in advance.
anu
 
Posts: 1
Joined: Mon Nov 30, 2015 11:04 am

Re: tsk_fs_file_read gives wrong content for deleted file

Postby rashidmtali » Tue Aug 30, 2016 10:52 am

please friend i am new to sleuthkit, but i want to install it and use this library to access image content please help how to do it!

email: rashidmtali@gmail.com
rashidmtali
 
Posts: 3
Joined: Tue Aug 30, 2016 10:22 am


Return to The Sleuth Kit (TSK)

Who is online

Users browsing this forum: No registered users and 2 guests

cron