blkcalc
Map a blkls stream byte offset from a sleuthkit-mode grep_unallocated hit to the real file-system block, so you can trace unallocated-space evidence back to its source on a disk image.
Instructions
Map a blkls stream byte offset (from a sleuthkit-mode grep_unallocated hit) to the real file-system block.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| part | No | ||
| image | Yes | ||
| blkls_offset | Yes |