Re: [sleuthkit-developers] Reading file data using the database tsk_file_layout information

[Brian C. <ca...@sl...>]

The C/C++ code doesn’t have any methods that use the DB info.  If you want to open a file mentioned in the DB though, you can use tsk_fs_file_open_meta.  If you want to open a given block, you can use tsk_fs_block….  to get it. 

The  Java side has code that uses that table. 




> On Sep 6, 2016, at 7:28 PM, Edward Diener <eld...@tr...> wrote:
> 
> How do I read the contents of a file from an image using the database's 
> tsk_file_layout information for a file ?
> 
> Is there a way to use some tsk file functionality to read the file's 
> data using the tsk_file_layout information ?
> 
> I have found out that the tsk_file_layout information for a file 
> contains blocks of data which has both the file data and non-file data 
> filling out the blocks, so a naive attempt at just reading the 
> information directly from the image using tsk_image_open and 
> tsk_image_read does not work.
> 
> Any help with this would be appreciated.
> 
> 
> 
> ------------------------------------------------------------------------------
> _______________________________________________
> sleuthkit-developers mailing list
> sle...@li...
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-developers