From TSK_FS_DIR, you can get the TSK_FS_FILE for the directory. From TSK_FS_FILE structure, you can get the TSK_FS_NAME structure and that has a par_addr field with the meta data address of the parent. You can then get a TSK_FS_DIR for that by using tsk_fs_dir_open_meta().
> On Jun 10, 2015, at 5:56 AM, Lloyd <llo...@gm...> wrote:
>
> Hi,
>
> Is it possible to get the parent directory from a TSK_FS_DIR structure based variable? I couldn't find anything related to this in the documentation.
>
> Thanks,
> Lloyd
>
> ------------------------------------------------------------------------------
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
|
