tsk - get clusters/sectors associated with a file

classic Classic list List threaded Threaded
2 messages Options
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

tsk - get clusters/sectors associated with a file

Lloyd-25
Hi,

In tsk, is it possible to get the sectors/clusters associated with a file using tsk API? If not which part of the source should i refer to get this information?

Thanks,
  Lloyd

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, SlashDot.org! http://sdm.link/slashdot
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: tsk - get clusters/sectors associated with a file

Brian Carrier-2
The easiest way is to do a "walk" on the file (or attribute).  There are a variety of ways of doing this.  Either tsk_fs_file_walk() or tsk_fs_attr_walk() will do it. 

You can pass in the TSK_FS_FILE_WALK_FLAG_AONLY flag if you care only about addresses.  That will be faster because it won't waste time loading file content into the buffer.  

There is an example callback in tsk/fs/ifind_lib.c (ifind_data_file_act()) that could be a useful starting place.


On Mon, Jan 16, 2017 at 11:59 PM, Lloyd <[hidden email]> wrote:
Hi,

In tsk, is it possible to get the sectors/clusters associated with a file using tsk API? If not which part of the source should i refer to get this information?

Thanks,
  Lloyd

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, SlashDot.org! http://sdm.link/slashdot
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org



------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, SlashDot.org! http://sdm.link/slashdot
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org
Loading...