[sleuthkit-developers] Explanation for V3 has_layout column of tsk_files table
Brought to you by:
carrier
From: Edward D. <eld...@tr...> - 2016-09-06 15:22:47
|
In the explanation for the has_layout column of the tsk_files table for the SQLite Database v3 Schema at http://wiki.sleuthkit.org/index.php?title=SQLite_Database_v3_Schema I see: "has_layout - True if file has an entry in tsk_file_layout" Yet after creating an Sqlite database from an image using version 4.2.0 of TSK I see in the tsk_files entries for allocated files NULL database values, even though all of these files have entries in the tsk_file_layout table. In fact only the vast majority of unallocated file entries have a value of 1 for this column and no entries have a value of 0 for this column. What is the actual explanation for this column ? Or does the value of this column only apply to unallocated file areas ? If the latter is the case the explanation in the V3 database should be corrected to say so. |