#80 New DB to support resident files

Auto (6)

It would be nice if the new DB schema would allow queries to map resident files to their file. fs_file_layout is byte-oriented, so this could work if TSK provided the specific byte-offset of resident files (a request that has come up a few times before).

The challenge is that the same byte sequence would be in fs_file_layout twice. Once for $MFT and another for the resident file... This could be confusing. But, it is also possible for there to be multiple overlapping carved files, so perhaps there isn't a requirement that fs_file_layout have only one entry for a given byte sequence.


  • Brian Carrier

    Brian Carrier - 2013-01-29
    • status: open --> closed
  • Brian Carrier

    Brian Carrier - 2013-01-29

    Closed and added to a growing list of requirements for hte next DB schema.


Get latest updates about Open Source Projects, Conferences and News.

Sign up for the SourceForge newsletter:

No, thanks