[sleuthkit-users] Different results between tsk_loaddb and java AddImageProcess

[Luís F. N. <lfc...@gm...>]

Hi,

Those 2 commands are populating the sqlite database with different number
of unallocated entries. Reading the code, the java command was configured
to group non adjacent unallocated clusters up to 500 MB, while tsk_loaddb
groups only adjacent blocks. Tsk_loaddb produced a sqlite with 26 millions
of unallocated entries in a specific case. I think those 2 commands should
return the same output, and I prefer the java one, because it makes caving
fragmented files easier.

Regards,
Luis Nassif