Re: [sleuthkit-users] byte_start in tsk_file_layout created by tsk_load_db

[Alex N. <ajn...@cs...>]

I confirm seeing the same as Simson:  When I was checking the resident byte
run thing from the other day, the byte runs I saw in the SQLite database
started at the partition, not the image.

--Alex

On Wed, Nov 26, 2014 at 5:49 PM, Simson Garfinkel <si...@ac...> wrote:

> The documentation [1] for the SQLite Database v3 Schema states that
> byte_start in tsk_file_layout is from the beginning of the image.
>
> Is this true? In some of my tests, it appears to be from the start of the
> partition, not from the start of the image.
>
> Thanks,
>
> Simson
>
>
>
>
>
>
>
>
>
> [1] http://wiki.sleuthkit.org/index.php?title=SQLite_Database_v3_Schema
>
>
> ------------------------------------------------------------------------------
> Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
> from Actuate! Instantly Supercharge Your Business Reports and Dashboards
> with Interactivity, Sharing, Native Excel Exports, App Integration & more
> Get technology previously reserved for billion-dollar corporations, FREE
>
> http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>
>