[sleuthkit-users] Listing files in a live disk

[Lloyd <llo...@gm...>]

Hi,

I am using libtsk (sleuthkit 4.2) to open and find files in a "live usb
disk (4gb)". For that I have used tsk_img_open_sing with TSK_IMG_TYPE_RAW.
The device name starts with "\\?\usbstor#..."

The files listed in this are incomplete and wrong.

So I took a raw image of the disk and again fed to tsk the same way, this
time it shows the result correctly.

Am I doing something wrong? When I checked the source of "tsk_img_open_sing
" it shows that opening "winobj" is supported.

Any guidance is greatly appreciated.

Thanks,
  Lloyd