Re: [sleuthkit-users] Parent dir from TSK_FS_DIR

[Brian C. <ca...@sl...>]

From TSK_FS_DIR, you can get the TSK_FS_FILE for the directory.  From TSK_FS_FILE structure, you can get the TSK_FS_NAME structure and that has a par_addr field with the meta data address of the parent.  You can then get a TSK_FS_DIR for that by using tsk_fs_dir_open_meta(). 



> On Jun 10, 2015, at 5:56 AM, Lloyd <llo...@gm...> wrote:
> 
> Hi,
> 
> Is it possible to get the parent directory from a TSK_FS_DIR structure based variable? I couldn't find anything related to this in the documentation.
> 
> Thanks,
>   Lloyd
> 
> ------------------------------------------------------------------------------
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org