[sleuthkit-users] TSK-4.4 and SlackFiles
Brought to you by:
carrier
From: Luís F. N. <lfc...@gm...> - 2017-01-31 12:04:42
|
Hi folks, I am upgrading to tsk-4.4 to benefit from the new support to slackfiles from java bindings. But I noticed some slackfiles larger than the cluster size (4k) are created in database. Some of them have megabytes of size and its contents are accessible. Is it expected to have slackfiles larger than cluster size? Could someone explain? Thanks, Luis Nassif |