[sleuthkit-users] TskAuto metadata issue

[Michael H. <mi...@ac...>]

Hi,

 

I have an application that sub-classes TskAuto to run through all the files
in an image. I've run into an issue where the file meta-data in the
TSK_FS_FILE structure passed to TskAuto::processFile represents a different
inode than is returned by opening the same file by path/filename using
tsk_fs_file_open. The inode address is different and the file content is
different.  If I look up the inode address passed to TskAuto::process file
using ffind, it indicates that it belongs to a different file.

 

Can someone please explain this behavior?

 

Thanks,

Mike