TSK_LOADDB(1) General Commands Manual TSK_LOADDB(1)
NAME
tsk_loaddb - populate a SQLite database with metadata from a disk image
SYNOPSIS
tsk_loaddb [-vVk] [-i imgtype ] [-b dev_sector_size ] [-i imgtype ] [-d output_dir ] image
DESCRIPTION
tsk_loaddb loads disk information from image to a sqlite database. This database can then be used by tools in other languages for analy-
sis. By default, the database is stored in the same directory as the image with ".db" appended to the name.
The arguments are as follows:
-d output_dir
specify a directory to output the database file to (must be an existing directory) if not specified the database file will be cre-
ated in the same directory as the image file
-v verbose output to stderr
-V Print version
-k Don't create block data table. This table maps each block to the file that allocated it. This option will make this program run
faster.
-i imgtype
The format of the image file (use '-i list' for supported types)
-b dev_sector_size
The size (in bytes) of the device sectors If -i or -b are not given, autodetection methods are used.
EXAMPLES
To load image data from image.dd to image.dd.db:
# tsk_loaddb ./image.dd
AUTHOR
Brian Carrier <carrier at sleuthkit dot org>
Send documentation updates to <doc-updates at sleuthkit dot org>
TSK_LOADDB(1)
