Re: [sleuthkit-users] TSK_VS_PART_INFO slot_num & table_num questions

[Jon S. <jo...@li...>]

Gotcha'. That makes sense, thank you for clarifying.

Both table_num and slot_num are -1 for the virtual "unallocated"
volumes. The addr field seems to be strictly increasing across all
real and virtual partitions alike.


Jon


On Thu, Dec 12, 2013 at 5:29 PM, Brian Carrier <ca...@sl...> wrote:
> Hey Jon,
>
> Disks formatted with DOS partitions can have multiple tables.  There is the primary tables and then extended tables.  The table_num increments for each of those extended tables. Other more sane partitioning systems will only have one table.
>
> Slot number is the entry in the table.   I'd need to review the code for exactly when -1 comes up.  When do you see it?
>
>
>
> On Dec 11, 2013, at 3:06 PM, Jon Stewart <jo...@li...> wrote:
>
>> Hello,
>>
>> In TSK_VS_PART_INFO, what is the difference between slot_num and
>> table_num (or is there none)? Under what conditions could either of
>> these values be equal to -1?
>>
>> thanks
>>
>> Jon
>> --
>> Jon Stewart, Principal
>> (646) 719-0317 | jo...@li... | Arlington, VA
>>
>> ------------------------------------------------------------------------------
>> Rapidly troubleshoot problems before they affect your business. Most IT
>> organizations don't have a clear picture of how application performance
>> affects their revenue. With AppDynamics, you get 100% visibility into your
>> Java,.NET, & PHP application. Start your 15-day FREE TRIAL of AppDynamics Pro!
>> http://pubads.g.doubleclick.net/gampad/clk?id=84349831&iu=/4140/ostg.clktrk
>> _______________________________________________
>> sleuthkit-users mailing list
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> http://www.sleuthkit.org
>



-- 
Jon Stewart, Principal
(646) 719-0317 | jo...@li... | Arlington, VA