sleuthkit-users

[sleuthkit-users] Novice question String Search

[Charlie F. <fr...@ma...>]

Hello, I am performing an investigation and am preparing a report. In 
the images.srch file which is created from a keyword search. What is the 
significance of the second value? For example

Cluster    2nd value     text match found
771098 | 1866              stringresult

This is from a WIndows XP system. Is the second value the INODE?

Thanks

Charlie

Re: [sleuthkit-users] Novice question String Search

[Brian C. <ca...@sl...>]

On Sep 21, 2004, at 1:38 PM, Charlie Fraser wrote:

> Hello, I am performing an investigation and am preparing a report. In 
> the images.srch file which is created from a keyword search. What is 
> the significance of the second value? For example
>
> Cluster    2nd value     text match found
> 771098 | 1866              stringresult
>
> This is from a WIndows XP system. Is the second value the INODE?

It is the byte offset of the string in the cluster.

brian