[sleuthkit-users] dls

[Geert V. A. <gee...@pa...>]

Dear brian and list members,

two little questions about dls.

1. dls extracts all unallocated data blocks (addressable disk units)
Assumption: dls also copies the slack space of an image, as long as 
these are addressable disk units.
Question: What about the bytes between the last byte of a regular file 
and the beginning of the next data block? Is there a way to copy them out?

2. What is the file structure of a dls output file. dls keeps the byte 
offset of the fragment, so is it something like:
254: data_of_the_block 289: data_of_another_block ... ?

Thanks for your help !

Geert