TSK_LOADDB(1)

💅 TSK_LOADDB — ok bestie, let's get you a database ✨

So like, tsk_loaddb is a lil command from the General Commands Manual (section 1, obvi) and it does one job and it does it gorgeously: it scoops all the metadata out of a disk image and drops it into a SQLite database. 🫶

---

✨ NAME ✨

tsk_loaddb — populate a SQLite database with metadata from a disk image 💖

---

🌸 SYNOPSIS 🌸

tsk_loaddb [-ahkvV] [ -i imgtype ] [ -b dev_sector_size ] [ -i imgtype ]
[ -d database ] image [images]

(Yes, -i imgtype shows up twice in there. We don't ask questions, we just report it faithfully. 🙈)

---

👑 DESCRIPTION 👑

tsk_loaddb loads disk information from an image into a SQLite database. And then? Other languages' tools can come through and do analysis on it. It's giving interoperability. 🌈

By default, the database lives in the same directory as the image, with ".db" appended to the name. OR you can pick your own name with -d, because you're the main character and you get choices. 💅

Here's the whole cast of arguments, no cap:

• -a — Adds the image to an existing database instead of creating a brand new one. It requires that -d also be specified, so don't try it alone bestie, it will not work. 😭
• -d database — Path for the database. Default is the same directory as the image, with the name derived from the image name.
• -v — verbose output to stderr 🗣️
• -V — Print version ⭐
• -k — Don't create the block data table. That table maps each block to the file that allocated it. Skipping it makes this program run faster. 🏃‍♀️💨
• -h — Calculate the MD5 hash value for each file and store it in a table. Heads up: this makes the program run slower. 🐌
• -i imgtype — The format of the image file, like raw. Use -i list to list all the supported types. If you don't give it, autodetection methods are used. 🔍
• -b dev_sector_size — The size (in bytes) of the device sectors. If you don't give it, autodetection methods are used.
• image [images] — The disk or partition image to read, whose format you gave with -i. You can hand over multiple image file names if the image is split into multiple segments. And get this: if you only give one image file and its name is the first in a sequence (like, as indicated by ending in '.001'), the subsequent image segments will be included automatically. 🪄✨

---

🎀 EXAMPLES 🎀

To load image data from image.dd to image.dd.db:

# tsk_loaddb ./image.dd

That's it. That's the whole vibe. 💖

---

🦋 AUTHOR 🦋

Brian Carrier <carrier at sleuthkit dot org> — an absolute icon, no notes. 👑

Send documentation updates to <doc-updates at sleuthkit dot org> — they want your feedback fr fr. 🫶

---

And that's a wrap on the tsk_loaddb(1) page from the General Commands Manual (TSK_LOADDB 1), bestie. It's from the Sleuth Kit, and you already know it ate. 💅✨