search for: do_download_inode

v2: - Rebase on top of master Matteo Cafasso (2): New API: download_blocks Added download_blocks API test daemon/sleuthkit.c | 41 ++++++++++++++++++++++++++- generator/actions.ml | 24 ++++++++++++++++ gobject/Makefile.inc | 2 ++ src/MAX_PROC_NR | 2 +- tests/tsk/Makefile.am | 1 +

...anges. Signed-off-by: Matteo Cafasso <noxdafox@gmail.com> --- daemon/sleuthkit.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/daemon/sleuthkit.c b/daemon/sleuthkit.c index ce738e3..e642731 100644 --- a/daemon/sleuthkit.c +++ b/daemon/sleuthkit.c @@ -47,7 +47,8 @@ do_download_inode (const mountable_t *mountable, int64_t inode) } /* Construct the command. */ - ret = asprintf(&cmd, "%s -r %s %" PRIi64, str_icat, mountable->device, inode); + ret = asprintf (&cmd, "%s -r %s %" PRIi64, + str_icat, mountable->device, inode...

With this API we complete the set of functions required to extract deleted files/data from most of the available filesystems. The function allows to extract data units (blocks) within a given range from a partition. The tests show an example on how the function can be used to retrieve deleted data. Matteo Cafasso (2): New API: download_blocks Added download_blocks API test

The command name is a bit confusing because it's similar to "cat" but act as "donwload". Therefore I am renaming it with a more clear name. At the same go I cleaned up a bit the code following the standards and improved the API documentation. This patch is ready for review. Code available at: https://github.com/noxdafox/libguestfs/tree/download_inode Matteo Cafasso (3):

...sk/Makefile.am | 1 + > tests/tsk/test-download-blocks.sh | 58 +++++++++++++++++++++++++++++++++++++++ > 6 files changed, 126 insertions(+), 2 deletions(-) > create mode 100755 tests/tsk/test-download-blocks.sh The series LGTM, I pushed it after removing the extra change in do_download_inode and fixing the version. More a curiosity question than a complain or something else: how are these APIs are supposed to be used? What is the forensics-related workflow using them? Considering they are quite specific, I was thinking about adding a documentation paragraph and/or some example to de...

...tput(const char *cmd); -GUESTFSD_EXT_CMD(str_sleuthkit_probe, icat); +GUESTFSD_EXT_CMD(str_icat, icat); -int -optgroup_sleuthkit_available (void) -{ - return prog_exists (str_sleuthkit_probe); -} - -int -do_icat (const mountable_t *mountable, int64_t inode) +/* Has one FileOut parameter. */ +int do_download_inode(const mountable_t *mountable, int64_t inode) { CLEANUP_FREE char *cmd = NULL; /* Inode must be greater than 0 */ if (inode < 0) { - reply_with_error ("inode must be >= 0"); + reply_with_error("inode must be >= 0"); + return -1; } /* Construc...

....sh delete mode 100755 tests/tsk/test-icat.sh diff --git a/daemon/sleuthkit.c b/daemon/sleuthkit.c index 0fe1250..2f8c97b 100644 --- a/daemon/sleuthkit.c +++ b/daemon/sleuthkit.c @@ -40,7 +40,7 @@ optgroup_sleuthkit_available (void) } int -do_icat (const mountable_t *mountable, int64_t inode) +do_download_inode (const mountable_t *mountable, int64_t inode) { CLEANUP_FREE char *cmd = NULL; diff --git a/generator/actions.ml b/generator/actions.ml index ff72cfe..e5cb939 100644 --- a/generator/actions.ml +++ b/generator/actions.ml @@ -12946,7 +12946,7 @@ The filesystem from which to extract the file must...

"icat" name comes from the employed command line tool which might be replaced later on with a different implementation. The command name is a bit confusing because it's similar to "cat" but act as "donwload". Therefore I am renaming it with a more clear name. At the same time I cleaned up a bit the code and improved it's readability and code comments. This

...d = true; diff --git a/daemon/sleuthkit.c b/daemon/sleuthkit.c index bdbdb0f89..acda48bc9 100644 --- a/daemon/sleuthkit.c +++ b/daemon/sleuthkit.c @@ -31,9 +31,6 @@ static int send_command_output (const char *cmd); -GUESTFSD_EXT_CMD(str_icat, icat); -GUESTFSD_EXT_CMD(str_blkls, blkls); - int do_download_inode (const mountable_t *mountable, int64_t inode) { @@ -47,8 +44,8 @@ do_download_inode (const mountable_t *mountable, int64_t inode) } /* Construct the command. */ - ret = asprintf (&cmd, "%s -r %s %" PRIi64, - str_icat, mountable->device, inode); + ret = a...

...dex bdbdb0f89..bde506ac4 100644 --- a/daemon/sleuthkit.c +++ b/daemon/sleuthkit.c @@ -31,8 +31,7 @@ static int send_command_output (const char *cmd); -GUESTFSD_EXT_CMD(str_icat, icat); -GUESTFSD_EXT_CMD(str_blkls, blkls); +DECLARE_EXTERNAL_COMMANDS ("icat", "blkls") int do_download_inode (const mountable_t *mountable, int64_t inode) @@ -47,8 +46,8 @@ do_download_inode (const mountable_t *mountable, int64_t inode) } /* Construct the command. */ - ret = asprintf (&cmd, "%s -r %s %" PRIi64, - str_icat, mountable->device, inode); + ret = aspr...

This is a simpler patch that removes GUESTFSD_EXT_CMD completely.

Replace GUESTFSD_EXT_CMD with a command line option ‘./guestfsd --print-external-commands’