Metadata Address

From SleuthKitWiki

Revision as of 11:01, 5 November 2008 by Carrier (Talk | contribs)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)

Jump to: navigation, search

Metadata Address is a term that is used in TSK as a generic term for the addresses of file system-specific data structures that store file metadata. Each file system has a different name for the structure(s) that store the metadata, including:

FAT: Directory entry
NTFS: MFT Entry
UFS: Inode
ExtX: Inode
HFS: Catalog record

The metadata address can be used in TSK to specify the files to analyze.

Retrieved from "https://wiki.sleuthkit.org/index.php?title=Metadata_Address&oldid=310"

Navigation menu