[sleuthkit-developers] [ sleuthkit-Feature Requests-3036083 ] TSK_FS_NAME has unique ID field

[SourceForge.net <no...@so...>]

Feature Requests item #3036083, was opened at 2010-07-28 11:50
Message generated for change (Tracker Item Submitted) made by 
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477892&aid=3036083&group_id=55685

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: API
Group: None
Status: Open
Priority: 5
Private: No
Submitted By: Jon S ()
Assigned to: Nobody/Anonymous (nobody)
Summary: TSK_FS_NAME has unique ID field

Initial Comment:
Add a field to the TSK_FS_NAME struct that can be used as a unique identifier and is stable relative to small differences in file system parsing.

The normal case is when a TSK_FS_NAME struct represents a filesystem record. In this case, the field will be populated with the byte offset of the record. This is useful, as it allows users the chance to refer to the structure manually, e.g., in a hex editor. For TSK_FS_NAME structs that have been generated by TSK, e.g., for orphan files, then the field will be populated with the address of the metadata record. That is, it'll have the same value as TSK_FS_NAME::meta_addr. This is also guaranteed to be unique.

c.f. https://sourceforge.net/mailarchive/forum.php?thread_name=9FAC1C96-926D-4F16-B59F-16C02C157377%40sleuthkit.org&forum_name=sleuthkit-developers

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477892&aid=3036083&group_id=55685