search for: download_inode

...quot;cat" but act as "donwload". Therefore I am renaming it with a more clear name. At the same go I cleaned up a bit the code following the standards and improved the API documentation. This patch is ready for review. Code available at: https://github.com/noxdafox/libguestfs/tree/download_inode Matteo Cafasso (3): Rename icat command in download_inode Improve download_inode documentation string. Code cleanup in daemon/sleuthkit.c daemon/sleuthkit.c | 50 ++++++++++++++++++++----------------- generator/actions.ml | 10 +++++--- tests/tsk/Makefile.am...

The "icat" name comes from the employed command line tool which might be replaced at any time with a different implementation. The command name is a bit confusing because it's similar to "cat" but act as "donwload". download_inode is more clear and descriptive. Signed-off-by: Matteo Cafasso <noxdafox@gmail.com> --- daemon/sleuthkit.c | 2 +- generator/actions.ml | 2 +- tests/tsk/Makefile.am | 2 +- tests/tsk/test-download-inode.sh | 53 ++++++++++++++++++++++++++++++++++++++++...

...to "cat" but act as "donwload". Therefore I am renaming it with a more clear name. At the same time I cleaned up a bit the code and improved it's readability and code comments. This patch is ready for review. Code available at: https://github.com/noxdafox/libguestfs/tree/download_inode Matteo Cafasso (2): rename icat API to download_inode updated download_inode tests daemon/sleuthkit.c | 79 ++++++++++++++++++++++------------------ generator/actions.ml | 6 ++- tests/tsk/Makefile.am | 2 +- tests/tsk/test-download-inode.sh | 53 ++++++...

...t(const char *cmd); -GUESTFSD_EXT_CMD(str_sleuthkit_probe, icat); +GUESTFSD_EXT_CMD(str_icat, icat); -int -optgroup_sleuthkit_available (void) -{ - return prog_exists (str_sleuthkit_probe); -} - -int -do_icat (const mountable_t *mountable, int64_t inode) +/* Has one FileOut parameter. */ +int do_download_inode(const mountable_t *mountable, int64_t inode) { CLEANUP_FREE char *cmd = NULL; /* Inode must be greater than 0 */ if (inode < 0) { - reply_with_error ("inode must be >= 0"); + reply_with_error("inode must be >= 0"); + return -1; } /* Construc...

On Wednesday, 24 August 2016 23:59:54 CEST Matteo Cafasso wrote: > The internal_find_inode command searches all entries referring to the > given inode and returns a tsk_dirent structure for each of them. > > The command is able to retrieve information regarding deleted > or unaccessible files where other commands such as stat or find > would fail. > > The gathered list of

...W.M. Jones wrote: > Split up the huge generator/actions.ml into several smaller files. Few notes: - regarding patch #2: wasn't the order stable before? Except from the explicitly seen order change in tests_c_api.ml, what made the actions order non-deterministic? - regarding patch #5: download_inode should be in actions_tsk.ml - regarding patch #5: I'm personally not fond of the _deprecated.ml versions: that means in case an API is deprecated, then it is moved from one place to another, IMHO for no reason. +1 for the split, -1 for the _deprecated split Thanks, -- Pino Toscano

...nge (except for stable_uuid which changed because the contents of the actions_*.ml files changed). Indeed there weren't any changes, which was how I verified the patch set. But for that to work I had to have a stable ordering that I could reproduce in the new code. > - regarding patch #5: download_inode should be in actions_tsk.ml OK, will fix. > - regarding patch #5: I'm personally not fond of the _deprecated.ml > versions: that means in case an API is deprecated, then it is moved > from one place to another, IMHO for no reason. > +1 for the split, -1 for the _deprecated s...

...tion would be to prefix all the forensics APIs with tsk_ as TSK (The Sleuth Kit) is the main tool used for implementing them. Other option could be giving generic names allowing us to change underlying tools without the need of deprecating the old APIs. Examples so far: * icat * tsk_icat * download_inode * blkcat * tsk_blkcat * download_blocks * blkls * tsk_blkls * download_unused_blocks * ffind * tsk_ffind * find_inode ... If we come to some final decision before the next stable release, I'll be glad to rename all the functions accordingly. Signed-off-by: Matteo Cafasso...

...lags' + +Bitfield containing extra information regarding the entry. + +The first bit controls the allocation state of the entry. +If set to C<1>, the file is allocated and visible within the filesystem. +Otherwise, the file has been deleted. +Under certain circumstances, the function C<download_inode> +can be used to recover deleted files. + +The second bit reports whether the metadata structure of the file +has been reallocated. +Filesystem such as NTFS and Ext2 or greater, separate the file name +from the metadata structure. +The bit is set to C<1> when the file name is in an unalloc...

v8: - rebase on master - bump version to 1.33.37 - squash commits 1, 2, 3 Kept original commits messages when squashing them. Matteo Cafasso (3): New API: internal_filesystem_walk New API: filesystem_walk lib: Added filesystem_walk command tests daemon/Makefile.am | 4 +- daemon/tsk.c | 249 ++++++++++++++++++++++++++++++++++++++

v5: - fixed compile-time warning - removed unused flag enumeration - new version 1.33.19 Patch ready for review. Matteo Cafasso (5): generator: Added tsk_dirent struct configure: Added libtsk compile-time check New API: internal_filesystem_walk New API: filesystem_walk lib: Added filesystem_walk command tests daemon/Makefile.am | 4 +- daemon/tsk.c

v4: - Changed tsk_allocated struct field into tsk_flags. - Added optional dependency in documentation. - Use asprintf and perror instead of asprintf_nowarn and fprintf. - Ensure CLEANUP_FREE vars are initialised. - Reworked the function documentation. - Improved tests robustness. Matteo Cafasso (5): generator: Added tsk_dirent struct configure: Added libtsk compile-time check

v6: - added metadata reallocation flag in tsk_flags Certain filesystems separate file name structures and metadata ones. Therefore, deleted entries with file name structures in an unallocated state might point to metadata structures which have been reallocated to new files. A flag set to 1 is generally an indication that the information gathered from the metadata structure (file

v7: - iterate over output file instead of reading it into memory Instead of reading the whole output file in memory and iterating over the resulting buffer, use XDR primitives to directly iterate over the file itself. This should reduce the API memory consumption. Patch ready for review. Code available at: https://github.com/noxdafox/libguestfs/tree/filesystem_walk Matteo Cafasso

v9: - add missing files: java/Makefile.inc, java/com/redhat/et/libguestfs/.gitignore, gobject/Makefile.inc - reserve space in tsk_dirent struct for future usage - use int instead of bool_t type - improve API documentation Matteo Cafasso (3): New API: internal_filesystem_walk New API: filesystem_walk lib: Added filesystem_walk command tests daemon/Makefile.am

...prove the quality random numbers generated for GUIDs and cryptographic key generation. API New APIs "btrfs_filesystem_show" List all devices where a btrfs filesystem is spanned (Pino Toscano). "download_blocks" "download_inode" "filesystem_walk" Download filesystem data blocks from a given partition. Download arbitrary files by inode number. Retrieve all files from a filesystem including deleted files. Note these require optional dependency The Sleuth K...

This is a follow-up to the other generator changes in: https://www.redhat.com/archives/libguestfs/2017-February/msg00217.html Rich.

Split up the huge generator/actions.ml into several smaller files. Rich.

...progress = true; cancellable = true; shortdesc = "search the entries associated to the given inode"; @@ -188,7 +188,7 @@ See C<filesystem_walk> for more information about C<tsk_dirent> structures." }; let daemon_functions = [ { defaults with name = "download_inode"; added = (1, 33, 14); - style = RErr, [Mountable "device"; Int64 "inode"; FileOut "filename"], []; + style = RErr, [String (Mountable, "device"); Int64 "inode"; String (FileOut, "filename")], []; optional = Some "sleu...

Very large but mechanical change to the generator. Rich.