bad DATA_RUN
Brought to you by:
carrier
Menu
▾
▴
#98 bad DATA_RUN
sleuthkit-3.0-2009-6-16 on Linux 2.6.29.4
The mechanism of reading the files using a very bad DATA_RUN works on "large" files (for example, 20 GB). In fact, the library has not read the entire chain of blocks of the file, the program is blocked. If your RAM is limited, "large" file do not get read if it is highly fragmented. Perhaps it makes sense to build DATA_RUN file in the pthread, blocking the main program only if the address of the requested block is not yet available at DATA_RUN.
I'm not sure if I am following the problem here. Are you using the read API that allows you to read at a given offset into a buffer or using the callback methods? I'm not sure what you are referring to with the pthreads and main programs. TSK currently does not have any notion of threading (unfortunately). Can you give more details on this?