sleuthkit-users

[sleuthkit-users] byte_start in tsk_file_layout created by tsk_load_db

[Simson G. <si...@ac...>]

The documentation [1] for the SQLite Database v3 Schema states that byte_start in tsk_file_layout is from the beginning of the image. 

Is this true? In some of my tests, it appears to be from the start of the partition, not from the start of the image.

Thanks,

Simson









[1] http://wiki.sleuthkit.org/index.php?title=SQLite_Database_v3_Schema <http://wiki.sleuthkit.org/index.php?title=SQLite_Database_v3_Schema>

Re: [sleuthkit-users] byte_start in tsk_file_layout created by tsk_load_db

[Alex N. <ajn...@cs...>]

I confirm seeing the same as Simson:  When I was checking the resident byte
run thing from the other day, the byte runs I saw in the SQLite database
started at the partition, not the image.

--Alex

On Wed, Nov 26, 2014 at 5:49 PM, Simson Garfinkel <si...@ac...> wrote:

> The documentation [1] for the SQLite Database v3 Schema states that
> byte_start in tsk_file_layout is from the beginning of the image.
>
> Is this true? In some of my tests, it appears to be from the start of the
> partition, not from the start of the image.
>
> Thanks,
>
> Simson
>
>
>
>
>
>
>
>
>
> [1] http://wiki.sleuthkit.org/index.php?title=SQLite_Database_v3_Schema
>
>
> ------------------------------------------------------------------------------
> Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
> from Actuate! Instantly Supercharge Your Business Reports and Dashboards
> with Interactivity, Sharing, Native Excel Exports, App Integration & more
> Get technology previously reserved for billion-dollar corporations, FREE
>
> http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>
>