[sleuthkit-developers] unique identifier for TSK_FS_NAME

[Jon <jo...@li...>]

Would it be possible to add a field to TSK_FS_NAME for the byte offset
of the record, either from the start of the volume or from the start
of the disk (whichever is easier)?

"addr" works as a good unique identifier for TSK_FS_META structs, and
something similar for TSK_FS_NAME would be helpful. Paths aren't
necessarily unique, and a segmented scheme using the parent
directory's path/inum with the index number of the TSK_FS_NAME record
is not stable... a new version of TSK might figure out a way to
recover more files in a directory (hypothetically) and now the index
number may be shifted to a different record. Reporting the byte offset
of the record would be more stable and have the added benefit of
letting people quickly find the raw data in a hex editor, for
validation/inspection.

Thoughts?

Jon