TSK_LOADDB(1) General Commands Manual TSK_LOADDB(1)NAME
tsk_loaddb - populate a SQLite database with metadata from a disk image
SYNOPSIS
tsk_loaddb [-vVk] [-i imgtype ] [-b dev_sector_size ] [-i imgtype ] [-d output_dir ] image
DESCRIPTION
tsk_loaddb loads disk information from image to a sqlite database. This database can then be used by tools in other languages for analy-
sis. By default, the database is stored in the same directory as the image with ".db" appended to the name.
The arguments are as follows:
-d output_dir
specify a directory to output the database file to (must be an existing directory) if not specified the database file will be cre-
ated in the same directory as the image file
-v verbose output to stderr
-V Print version
-k Don't create block data table. This table maps each block to the file that allocated it. This option will make this program run
faster.
-i imgtype
The format of the image file (use '-i list' for supported types)
-b dev_sector_size
The size (in bytes) of the device sectors If -i or -b are not given, autodetection methods are used.
EXAMPLES
To load image data from image.dd to image.dd.db:
# tsk_loaddb ./image.dd
AUTHOR
Brian Carrier <carrier at sleuthkit dot org>
Send documentation updates to <doc-updates at sleuthkit dot org>
TSK_LOADDB(1)
Check Out this Related Man Page
IMG_CAT(1) General Commands Manual IMG_CAT(1)NAME
img_cat - Output contents of an image file.
SYNOPSIS
img_cat [-i imgtype] [-b dev_sector_size] [-b start_sector] [-e stop_sector] [-vV] image [images]
DESCRIPTION
img_cat outputs the contents of an image file. Image files that are not raw will have embedded data and metadata. img_cat will output
only the data. This allows you to convert an embedded format to raw or to calculate the MD5 hash of the data by piping the output to the
appropriate tool.
ARGUMENTS -i imgtype
Identify the type of image file, such as raw, split, or aff. Use '-i list' to list the supported types. If not given, autodetec-
tion methods are used.
-b dev_sector_size
The size, in bytes, of the underlying device sectors. If not given, the value in the image format is used (if it exists) or
512-bytes is assumed.
-s start_sector
The sector number to start at.
-e stop_sector
The sector number to stop at.
-v Verbose output of debugging statements to stderr
-V Display version
image [images]
One (or more if split) disk or partition images whose format is given with '-i'.
AUTHOR
Brian Carrier <carrier at sleuthkit dot org>
Send documentation updates to <doc-updates at sleuthkit dot org>
IMG_CAT(1)
Hi everybody,
We have a cgi application which accesses sqlite database. It works fine in Linux environment but the same code doesn't enter data into the database when done in HP-UX environment. Should the codes vary depending on whether it is Linux or HP-UX.
Regards
Ruma (1 Reply)
This may be a dumb question and the more I think about it the worst it seems!!
I have inherited some standalone systems where they are using the mksysb command to create a disk file image; this image is then backed up to Networker.
My dumb question is how would we go about restoring this... (4 Replies)
Hi,
Please can anyone advise if Acronis true image can be used to take a image backup of the disk on sco unixware 7.1.4 and what version of software would I need to use this. The FS are vxfs. Would I need to power off the server before I can use this.
Thanks (1 Reply)