Re: [sleuthkit-developers] Finding byte offset of file on disk

[Brian C. <ca...@sl...>]

Sure.  Before you get to a TSK_FS_META, you must have had a TSK_FS_INFO. It contains all the info you need.  

byte_offset_relative_to_disk = fs_info->offset + (OFFSET_FROM_META * fs_info->block_size)




On Aug 28, 2013, at 4:11 PM, Robert James <sro...@gm...> wrote:

>> From a TSK_FS_META, I know how to find the offset of every run making
> up the file. But those offsets are relative to the start of the
> _filesystem_, and in units of filesystem blocks.
> 
> I'd like to turn those into offsets relative to the start of the
> _disk_, factoring in any filesystem or volume system. And I'd like
> them in units of bytes (or device sectors).
> 
> That is, given a TSK_FS_META, I'd like to find the byte offset in the
> disk of the runs. Something I could feed right into dd. Can I do this?
> How?
> 
> ------------------------------------------------------------------------------
> Learn the latest--Visual Studio 2012, SharePoint 2013, SQL 2012, more!
> Discover the easy way to master current and previous Microsoft technologies
> and advance your career. Get an incredible 1,500+ hours of step-by-step
> tutorial videos with LearnDevNow. Subscribe today and save!
> http://pubads.g.doubleclick.net/gampad/clk?id=58040911&iu=/4140/ostg.clktrk
> _______________________________________________
> sleuthkit-developers mailing list
> sle...@li...
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-developers