Add unallocated block list to TSK db
Brought to you by:
carrier
Menu
▾
▴
#67 Add unallocated block list to TSK db
The database feature of TSK 3.2.0 is a great enhancement to TSK allowing for major speed enhancements by following a "parse the image once but read results many times model." The table can be read directly and simple tools/scripts can be crafted to read the table rather than the image itself.
However, the tsk_fs_blocks table only maps allocated blocks. The mapping of unallocated blocks would allow tools to make quick calculations of any byte offset in the image, enhancing TSK over the current slower blkcalc tool.
