Scroll to navigation

TSK_LOADDB(1) General Commands Manual TSK_LOADDB(1)

NAME

tsk_loaddb - populate a SQLite database with metadata from a disk image

SYNOPSIS

tsk_loaddb [-vVk] [-i imgtype ] [-b dev_sector_size ] [-i imgtype ] [-d output_dir ] image

DESCRIPTION

tsk_loaddb loads disk information from image to a sqlite database. This database can then be used by tools in other languages for analysis. By default, the database is stored in the same directory as the image with ".db" appended to the name.
 
The arguments are as follows:
-d output_dir
specify a directory to output the database file to (must be an existing directory) if not specified the database file will be created in the same directory as the image file
-v
verbose output to stderr
-V
Print version
-k
Don't create block data table. This table maps each block to the file that allocated it. This option will make this program run faster.
-i imgtype
The format of the image file (use '-i list' for supported types)
-b dev_sector_size
The size (in bytes) of the device sectors If -i or -b are not given, autodetection methods are used.
 

EXAMPLES

To load image data from image.dd to image.dd.db:
 
# tsk_loaddb ./image.dd
 
 

AUTHOR

Brian Carrier <carrier at sleuthkit dot org>
 
Send documentation updates to <doc-updates at sleuthkit dot org>