Menu

#56 TSK_FS_NAME has unique ID field

open
nobody
API (11)
5
2010-07-28
2010-07-28
Anonymous
No

Add a field to the TSK_FS_NAME struct that can be used as a unique identifier and is stable relative to small differences in file system parsing.

The normal case is when a TSK_FS_NAME struct represents a filesystem record. In this case, the field will be populated with the byte offset of the record. This is useful, as it allows users the chance to refer to the structure manually, e.g., in a hex editor. For TSK_FS_NAME structs that have been generated by TSK, e.g., for orphan files, then the field will be populated with the address of the metadata record. That is, it'll have the same value as TSK_FS_NAME::meta_addr. This is also guaranteed to be unique.

c.f. https://sourceforge.net/mailarchive/forum.php?thread_name=9FAC1C96-926D-4F16-B59F-16C02C157377%40sleuthkit.org&forum_name=sleuthkit-developers

Discussion


Log in to post a comment.