New DB to support resident files
Brought to you by:
carrier
Menu
▾
▴
#80 New DB to support resident files
It would be nice if the new DB schema would allow queries to map resident files to their file. fs_file_layout is byte-oriented, so this could work if TSK provided the specific byte-offset of resident files (a request that has come up a few times before).
The challenge is that the same byte sequence would be in fs_file_layout twice. Once for $MFT and another for the resident file... This could be confusing. But, it is also possible for there to be multiple overlapping carved files, so perhaps there isn't a requirement that fs_file_layout have only one entry for a given byte sequence.
Closed and added to a growing list of requirements for hte next DB schema.