Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

HFS files always named with "resource fork" #376

Open
kefir- opened this issue Nov 11, 2014 · 0 comments
Open

HFS files always named with "resource fork" #376

kefir- opened this issue Nov 11, 2014 · 0 comments

Comments

@kefir-
Copy link
Contributor

kefir- commented Nov 11, 2014

When using tsk_loaddb to load an image with an HFS file system, all the files stored in the database are named with the (default?) :DATA resource fork. So if I run a query like:

select * from tsk_files where name like '%.doc";

I don't get any matches. However, if I run:

select * from tsk_files where name like '%.doc:data";

then I get lots of hits, and I have to strip off the final 5 characters ":DATA" manually. I think this is an unnecessary special case, and I believe this is also the cause of the seemingly related Autopsy issue at sleuthkit/autopsy#903.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant