search for: 0fe1250

....c \ sh.c \ sleep.c \ + sleuthkit.c \ stat.c \ statvfs.c \ strings.c \ @@ -179,7 +180,6 @@ guestfsd_SOURCES = \ syslinux.c \ tar.c \ truncate.c \ - tsk.c \ umask.c \ upload.c \ utimens.c \ diff --git a/daemon/sleuthkit.c b/daemon/sleuthkit.c new file mode 100644 index 0000000..0fe1250 --- /dev/null +++ b/daemon/sleuthkit.c @@ -0,0 +1,114 @@ +/* libguestfs - the guestfsd daemon + * Copyright (C) 2016 Red Hat Inc. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Softwa...

...to 'available sleuthkit'. Signed-off-by: Matteo Cafasso <noxdafox@gmail.com> --- daemon/tsk.c | 6 +++--- generator/actions.ml | 2 +- tests/tsk/test-icat.sh | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/daemon/tsk.c b/daemon/tsk.c index 647d1e7..0fe1250 100644 --- a/daemon/tsk.c +++ b/daemon/tsk.c @@ -31,12 +31,12 @@ static int file_out (const char *cmd); -GUESTFSD_EXT_CMD(str_tsk_probe, icat); +GUESTFSD_EXT_CMD(str_sleuthkit_probe, icat); int -optgroup_icat_available (void) +optgroup_sleuthkit_available (void) { - return prog_exists (str_t...

Signed-off-by: Matteo Cafasso <noxdafox@gmail.com> --- daemon/sleuthkit.c | 79 ++++++++++++++++++++++++++++------------------------ generator/actions.ml | 6 ++-- 2 files changed, 47 insertions(+), 38 deletions(-) diff --git a/daemon/sleuthkit.c b/daemon/sleuthkit.c index 0fe1250..536febb 100644 --- a/daemon/sleuthkit.c +++ b/daemon/sleuthkit.c @@ -29,55 +29,55 @@ #include "actions.h" #include "optgroups.h" -static int file_out (const char *cmd); +int optgroup_sleuthkit_available(void); +static int send_command_output(const char *cmd); -GUESTFSD_EXT_...

blkcat allows to extract files given their data units (clusters for NTFS, fragments for ExtX). This API allows to recover files which icat cannot. For example icat often fails retrieving deleted files on Ext3/Ext4 filesystems. As this API works at data unit level, some garbage at the beginning or at the end of the files is expected. An example of blkcat can be found here:

...+++++++++++ tests/tsk/test-icat.sh | 53 ---------------------------------------- 5 files changed, 56 insertions(+), 56 deletions(-) create mode 100755 tests/tsk/test-download-inode.sh delete mode 100755 tests/tsk/test-icat.sh diff --git a/daemon/sleuthkit.c b/daemon/sleuthkit.c index 0fe1250..2f8c97b 100644 --- a/daemon/sleuthkit.c +++ b/daemon/sleuthkit.c @@ -40,7 +40,7 @@ optgroup_sleuthkit_available (void) } int -do_icat (const mountable_t *mountable, int64_t inode) +do_download_inode (const mountable_t *mountable, int64_t inode) { CLEANUP_FREE char *cmd = NULL; diff --git a...

"icat" name comes from the employed command line tool which might be replaced later on with a different implementation. The command name is a bit confusing because it's similar to "cat" but act as "donwload". Therefore I am renaming it with a more clear name. At the same time I cleaned up a bit the code and improved it's readability and code comments. This

The command name is a bit confusing because it's similar to "cat" but act as "donwload". Therefore I am renaming it with a more clear name. At the same go I cleaned up a bit the code following the standards and improved the API documentation. This patch is ready for review. Code available at: https://github.com/noxdafox/libguestfs/tree/download_inode Matteo Cafasso (3):