tsk_loaddb obj_id is postponed tsk_vs_parts - tsk_files

Tool requests, development, and troubleshooting topics related to TSK.

Moderator: carrier

tsk_loaddb obj_id is postponed tsk_vs_parts - tsk_files

Postby Denny » Tue Jul 25, 2017 11:27 pm

Hi,

im playing with tsk_loaddb and found a issue. In the table 'tsk_vs_parts' is the obj_id i.e. 12843 for a USERDATA partition of a Android device. In the table 'tsk_files' is obj_id incremented by 1 = 12844. All partitions/obj_id's are postponed.

I have testet it with 2 filedumps with TSK 4.4.1 under Windows 10.

Bug or Feature? Thanks.
Denny
Denny
 
Posts: 1
Joined: Tue Jul 25, 2017 11:18 pm

Return to The Sleuth Kit (TSK)

Who is online

Users browsing this forum: No registered users and 0 guests