manpagez: man pages & more
man tsk_loaddb(1)
Home | html | info | man
tsk_loaddb(1)                                                    tsk_loaddb(1)




NAME

       tsk_loaddb - populate a SQLite database with metadata from a disk image


SYNOPSIS

       tsk_loaddb [-ahkvV] [ -i imgtype ] [ -b dev_sector_size ] [ -i  imgtype
       ] [ -d database ] image [images]


DESCRIPTION

       tsk_loaddb  loads  disk  information  from  image to a SQLite database.
       This database can then be used by tools in other languages  for  analy-
       sis.  By  default,  the database is stored in the same directory as the
       image with ".db" appended to the name or the database name can be spec-
       ified with '-d'.

       The arguments are as follows:

       -a     Adds  image  to  an  existing database instead of creating a new
              one.  Requires that -d be also specified.

       -d database
              Path for the database (default is  the  same  directory  as  the
              image with name derived from image name

       -v     verbose output to stderr

       -V     Print version

       -k     Don't  create  block  data table.  This table maps each block to
              the file that allocated it.  This option will make this  program
              run faster.

       -h     Calculate  MD5  hash  value for each file and store it in table.
              This option will make the program run slower.

       -i imgtype
              The format of the image file, such as raw.   Use  '-i  list'  to
              list  the  supported types.  If not given, autodetection methods
              are used.

       -b dev_sector_size
              The size (in bytes)  of  the  device  sectors.   If  not  given,
              autodetection methods are used.

       image [images]
              The  disk or partition image to read, whose format is given with
              '-i'.  Multiple image file names can be given if  the  image  is
              split  into multiple segments.  If only one image file is given,
              and its name is the first in a sequence (e.g., as  indicated  by
              ending  in  '.001'),  subsequent image segments will be included
              automatically.



EXAMPLES

       To load image data from image.dd to image.dd.db:

            # tsk_loaddb ./image.dd




AUTHOR

       Brian Carrier <carrier at sleuthkit dot org>

       Send documentation updates to <doc-updates at sleuthkit dot org>



                                                                 tsk_loaddb(1)

sleuthkit 4.6.5 - Generated Sun Feb 17 10:40:00 CST 2019
© manpagez.com 2000-2024
Individual documents may contain additional copyright information.