Re: [sleuthkit-users] TSK_FS_ATTR_INUSE

[Jon S. <jo...@li...>]

So, to confirm my understanding, such attributes are "sleuthkit
slack", and not actual unallocated/trace attributes, and can be
ignored entirely?

thanks,

Jon


On Thu, Dec 12, 2013 at 5:33 PM, Brian Carrier <ca...@sl...> wrote:
> That means the corresponding TSK_FS_ATTR structure has valid data in it.  The TSK_FS_META and TSK_FS_ATTR structures are re-used in some contexts instead of freeing and reallocating memory.   If that flag isn't set, then don't use the data in the structure.
>
>
>
>
> On Dec 12, 2013, at 4:46 PM, Jon Stewart <jo...@li...> wrote:
>
>> Hello,
>>
>> One of the TSK_FS_ATTR_FLAG_ENUM values is TSK_FS_ATTR_INUSE, and the
>> comment for the value is "data structure is in use". Can anyone on the
>> list elaborate on this value's meaning? When is it not set on an
>> attribute?
>>
>> Thanks!
>>
>> Jon
>> --
>> Jon Stewart, Principal
>> (646) 719-0317 | jo...@li... | Arlington, VA
>>
>> ------------------------------------------------------------------------------
>> Rapidly troubleshoot problems before they affect your business. Most IT
>> organizations don't have a clear picture of how application performance
>> affects their revenue. With AppDynamics, you get 100% visibility into your
>> Java,.NET, & PHP application. Start your 15-day FREE TRIAL of AppDynamics Pro!
>> http://pubads.g.doubleclick.net/gampad/clk?id=84349831&iu=/4140/ostg.clktrk
>> _______________________________________________
>> sleuthkit-users mailing list
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> http://www.sleuthkit.org
>



-- 
Jon Stewart, Principal
(646) 719-0317 | jo...@li... | Arlington, VA