[sleuthkit-users] istat Output - Direct Blocks Question

[Efstratios S. <esk...@gm...>]

Dear all,

I have a question about the tool istat from sleuth kit library API.
Using the tool we get some Direct block "addresses" like on the
following example :

inode: 2670461
Allocated
Group: 326
Generation Id: 2797282208
uid / gid: 1000 / 1000
mode: rrw-------
size: 6613
num of links: 1

Inode Times:
Accessed:	2015-12-03 11:03:34 (EET)
File Modified:	2015-03-27 14:05:13 (EET)
Inode Modified:	2015-11-30 18:16:04 (EET)

Direct Blocks:
21120876 21120877

 Those Direct Blocks (numbers) are the Physical Addresses of Blocks on
the virtual storage ? Virtual addresses of the blocks ? what exactly?

 If I use blkcat and one of those number I get correct output of the
file I am viewing.

 My intention is to write a file on a domU of Xen from a dom0
perspective. I tried to use write() function but got a bad file
descriptor error ..

Thanks,
Efstratios