Re: [sleuthkit-users] Tsk_loaddb generating an inconsistent file system tree

[Luís F. N. <lfc...@gm...>]

Hi Mauricio,

I think you are right. The fix uses parent paths to choose the correct
parent, so it will not work if the possible parents have the same path and
name. I think there should be another approach for the fix, because the
child paths always were ok, so tsk knows the correct parent at some point.

Luis

2016-06-24 15:10 GMT-03:00 Mauricio Lage <mau...@gm...>:

> Hi,
> I have verified the same issue with a case I am currently working on: many
> allocated files were put into a wrong deleted parent folder. But some of
> those wrong deleted parent folders have exactly the same name and path of
> the true parent folders. For example, there are two "Program Files" folders
> in the root, one allocated and one deleted, and many allocated children
> were put below the deleted "Program Files". So I think the current fix,
> that uses the parent paths to decide into which folder they will be put,
> will not work for some cases like mine.
>
> thanks,
>
> --
> Mauricio S. Lage
>
>
>
> ------------------------------------------------------------------------------
> Attend Shape: An AT&T Tech Expo July 15-16. Meet us at AT&T Park in San
> Francisco, CA to explore cutting-edge tech and listen to tech luminaries
> present their vision of the future. This family event has something for
> everyone, including kids. Get more information and register today.
> http://sdm.link/attshape
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>
>