Tsk_loaddb ids between different runs

The Sleuth Kit Development
1

Hello everyone!

Is it safe to assume obj_id of tsk_files table in sqlite generated by tsk_loaddb does not change between different runs of tsk_loaddb when comparing the same artifacts?

I am planning to implement a “continue aborted processing” in IPED forensic tool (https://github.com/lfcnassif/IPED) and if that is true, I will be able to recover even processing stopped before tsk_loaddb finishes.

Thank you,

Luis Nassif

2

I’m fairly sure the IDs will be the same. tsk_loaddb is single-threaded and nothing else should be changing the database while it is running.

3

Thanks, Ann! I thought that, but I would like to confirm it.