Reading file data using the tsk_file_layout information

Tool requests, development, and troubleshooting topics related to TSK.

Moderator: carrier

Reading file data using the tsk_file_layout information

Postby eldiener » Wed Sep 07, 2016 2:11 am

How do I read the contents of a file from an image using the database's tsk_file_layout information for a file ?

Is there a way to use some tsk file functionality to read the file's data using the tsk_file_layout information ?

I have found out that the tsk_file_layout information for a file contains blocks of data which has both the file data and non-file data filling out the blocks, so a naive attempt at just reading the information directly from the image using tsk_image_open and tsk_image_read does not work.

Any help with this would be appreciated.
eldiener
 
Posts: 4
Joined: Thu Jun 23, 2016 3:02 pm

Return to The Sleuth Kit (TSK)

Who is online

Users browsing this forum: Bing [Bot] and 1 guest

cron