[sleuthkit-users] byte_start in tsk_file_layout created by tsk_load_db

[Simson G. <si...@ac...>]

The documentation [1] for the SQLite Database v3 Schema states that byte_start in tsk_file_layout is from the beginning of the image. 

Is this true? In some of my tests, it appears to be from the start of the partition, not from the start of the image.

Thanks,

Simson









[1] http://wiki.sleuthkit.org/index.php?title=SQLite_Database_v3_Schema <http://wiki.sleuthkit.org/index.php?title=SQLite_Database_v3_Schema>