[sleuthkit-developers] [ sleuthkit-Feature Requests-3192458 ] Add unallocated block list to TSK db

[SourceForge.net <no...@so...>]

Feature Requests item #3192458, was opened at 2011-02-25 09:13
Message generated for change (Tracker Item Submitted) made by jlehr
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477892&aid=3192458&group_id=55685

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: Auto
Group: None
Status: Open
Priority: 5
Private: No
Submitted By: John Lehr (jlehr)
Assigned to: Nobody/Anonymous (nobody)
Summary: Add unallocated block list to TSK db

Initial Comment:
The database feature of TSK 3.2.0 is a great enhancement to TSK allowing for major speed enhancements by following a "parse the image once but read results many times model."  The table can be read directly and simple tools/scripts can be crafted to read the table rather than the image itself.

However, the tsk_fs_blocks table only maps allocated blocks.  The mapping of unallocated blocks would allow tools to make quick calculations of any byte offset in the image, enhancing TSK over the current slower blkcalc tool.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477892&aid=3192458&group_id=55685