Zeroing file inside an image

The Sleuth Kit Development
1

Hi guys,
I am new to both the sleuthkit library and this forum, I apologize for any inconvenience.
I’m developing a software that manipulates the disk image, while analyzing it. I know that that’s pretty unusual in forensics. Basically, I need to ‘zero-out’ the files I’m not interested in. About the file content, that is actually quite easy. Once you have the block number in which the file stores its content, you just need to calculate the offset (which works for any file system) and zero it out. But now I need to zero out the metadata address as well.

Is there any function in the library that would let me do it for any fs type? If not, can you help me with an high-level description of the procedure?

At the moment, I know more or less how to get the inode entry on the disk once I get the inode number, but that is just for ext* systems. Besides, I am not sure on how to proceed on the others (NTFS, FAT).

Thank you so much for your help.

2

Sleuthkit and Autopsy will only read the filesystem, they will not write to the filesystem.

3

That is pretty clear to me, that’s why I wrote that it’s an unusual request. Besides, I’m not using the command line utilities, nor Autopsy, just the C library for developing my own software. What I was actually asking was: does anybody know the way to get the metadata file structure offset on the image, so that I can zero it out in my own way?
But thanks anyway.