You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When using tsk_loaddb to load an image with an HFS file system, all the files stored in the database are named with the (default?) :DATA resource fork. So if I run a query like:
select * from tsk_files where name like '%.doc";
I don't get any matches. However, if I run:
select * from tsk_files where name like '%.doc:data";
then I get lots of hits, and I have to strip off the final 5 characters ":DATA" manually. I think this is an unnecessary special case, and I believe this is also the cause of the seemingly related Autopsy issue at sleuthkit/autopsy#903.
The text was updated successfully, but these errors were encountered:
When using tsk_loaddb to load an image with an HFS file system, all the files stored in the database are named with the (default?) :DATA resource fork. So if I run a query like:
I don't get any matches. However, if I run:
then I get lots of hits, and I have to strip off the final 5 characters ":DATA" manually. I think this is an unnecessary special case, and I believe this is also the cause of the seemingly related Autopsy issue at sleuthkit/autopsy#903.
The text was updated successfully, but these errors were encountered: