#67 Add unallocated block list to TSK db

open
nobody
Auto (6)
5
2011-02-25
2011-02-25
John Lehr
No

The database feature of TSK 3.2.0 is a great enhancement to TSK allowing for major speed enhancements by following a "parse the image once but read results many times model." The table can be read directly and simple tools/scripts can be crafted to read the table rather than the image itself.

However, the tsk_fs_blocks table only maps allocated blocks. The mapping of unallocated blocks would allow tools to make quick calculations of any byte offset in the image, enhancing TSK over the current slower blkcalc tool.

Discussion


Log in to post a comment.

Get latest updates about Open Source Projects, Conferences and News.

Sign up for the SourceForge newsletter:





No, thanks