Re: [sleuthkit-users] body file + checksum - any tools?

[Brian C. <ca...@sl...>]

tsk_gettimes will display two lines for each file.  One with times from STD_INFO and one from $FILE_NAME. It has the limitation that if there are multiple $FILE_NAME attributes, it shows only one.


On Mar 13, 2014, at 6:48 PM, RB <ao...@gm...> wrote:

> On Thu, Mar 13, 2014 at 4:10 PM, Brian Carrier <ca...@sl...> wrote:
>> tsk_loaddb is fixed in the develop branch.
> 
> Excellent, thank you - tsk_gettimes -m is sufficing for what I need right now.
> 
> I know we discussed the 8-timestamp thing a while ago (Simson
> included), and the initial decision was to put that out as more
> columns.  Has any progress been made on that?  I'd love to see either
> (or both) TSK and fiwalk produce that kind of data with a runtime
> flag.
> 
> ------------------------------------------------------------------------------
> Learn Graph Databases - Download FREE O'Reilly Book
> "Graph Databases" is the definitive new guide to graph databases and their
> applications. Written by three acclaimed leaders in the field,
> this first edition is now available. Download your free book today!
> http://p.sf.net/sfu/13534_NeoTech
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org