[sleuthkit-developers] Reading file data using the database tsk_file_layout information
Brought to you by:
carrier
From: Edward D. <eld...@tr...> - 2016-09-06 23:28:12
|
How do I read the contents of a file from an image using the database's tsk_file_layout information for a file ? Is there a way to use some tsk file functionality to read the file's data using the tsk_file_layout information ? I have found out that the tsk_file_layout information for a file contains blocks of data which has both the file data and non-file data filling out the blocks, so a naive attempt at just reading the information directly from the image using tsk_image_open and tsk_image_read does not work. Any help with this would be appreciated. |