[sleuthkit-developers] Finding byte offset of file on disk
Brought to you by:
carrier
From: Robert J. <sro...@gm...> - 2013-08-28 20:11:56
|
>From a TSK_FS_META, I know how to find the offset of every run making up the file. But those offsets are relative to the start of the _filesystem_, and in units of filesystem blocks. I'd like to turn those into offsets relative to the start of the _disk_, factoring in any filesystem or volume system. And I'd like them in units of bytes (or device sectors). That is, given a TSK_FS_META, I'd like to find the byte offset in the disk of the runs. Something I could feed right into dd. Can I do this? How? |