Re: [sleuthkit-users] body file + checksum - any tools?

[Simson G. <si...@ac...>]

fiwalk should do this, but it won’t give you all 8 timestamps. It could be modified to do so, however.

On Mar 13, 2014, at 4:10 PM, RB <ao...@gm...> wrote:

> I guess tsk_loaddb would be the appropriate answer here, but is there
> anything that, say, would do dfxml output of all 8 timestamps from
> NTFS?
> 
> On Thu, Mar 13, 2014 at 1:52 PM, RB <ao...@gm...> wrote:
>> Does anyone know of a tool that actually fills out the checksum field
>> of the current body file format?  I'm trying to find more efficient
>> ways to snag the checksums than mounting the partition and runnning
>> md5deep over it.  Thoughts?
> 
> ------------------------------------------------------------------------------
> Learn Graph Databases - Download FREE O'Reilly Book
> "Graph Databases" is the definitive new guide to graph databases and their
> applications. Written by three acclaimed leaders in the field,
> this first edition is now available. Download your free book today!
> http://p.sf.net/sfu/13534_NeoTech
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org