search for: eccef00

...Root */ + STREQ(fsfile->name->name, ".")) /* Avoid '..' 'bin/..' 'etc/..' */ + return 0; + else + return 1; + } + + return 0; +} + int optgroup_libtsk_available (void) { diff --git a/generator/actions.ml b/generator/actions.ml index eccef00..0698b4f 100644 --- a/generator/actions.ml +++ b/generator/actions.ml @@ -3566,9 +3566,8 @@ and directories stored within. It is not necessary to mount the disk partition to run this command. -All entries in the filesystem are returned, excluding C<.> and -C<..>. This function can...

...n TSK_WALK_CONT; + + ret = send_dirent_info (fsfile, path); + + return (ret == 0) ? TSK_WALK_CONT : TSK_WALK_ERROR; +} + /* Extract the information from the entry, serialize and send it out. * Return 0 on success, -1 on error. */ diff --git a/generator/actions.ml b/generator/actions.ml index eccef00..449443f 100644 --- a/generator/actions.ml +++ b/generator/actions.ml @@ -13205,6 +13205,15 @@ only the unallocated blocks will be extracted. This is useful to detect hidden data or to retrieve deleted files which data units have not been overwritten yet." }; + { defaults with + name =...

...metadata (fsfile->meta, &dirent); + + ret = send_dirent_info (&dirent); + + return (ret == 0) ? TSK_WALK_CONT : TSK_WALK_ERROR;; +} + /* Inspect fsfile to identify its type. */ static char file_type (TSK_FS_FILE *fsfile) diff --git a/generator/actions.ml b/generator/actions.ml index eccef00..449443f 100644 --- a/generator/actions.ml +++ b/generator/actions.ml @@ -13205,6 +13205,15 @@ only the unallocated blocks will be extracted. This is useful to detect hidden data or to retrieve deleted files which data units have not been overwritten yet." }; + { defaults with + name =...

...excl = remove; + + r = aug_transform (aug, lens, file, excl); + if (r == -1) { + AUGEAS_ERROR ("aug_transform: %s: %s: %s", lens, file, excl ? "excl" : "incl"); + return -1; + } + + return r; +} diff --git a/generator/actions.ml b/generator/actions.ml index eccef00..aa26649 100644 --- a/generator/actions.ml +++ b/generator/actions.ml @@ -13205,6 +13205,18 @@ only the unallocated blocks will be extracted. This is useful to detect hidden data or to retrieve deleted files which data units have not been overwritten yet." }; + { defaults with + name =...

The find_inode API allows the User to search all the entries referring to a given inode and returns a tsk_dirent structure for each of them. As I didn't want to change unrelated code, there is a little bit of code duplication at the moment. Plan is to refactor the logic in a dedicated set of patches. Matteo Cafasso (3): New API: internal_find_inode New API: find_inode find_inode: added

v3: - coding style fixes - comment entry_is_dot logic Matteo Cafasso (6): filesystem_walk: fixed root inode listing daemon: refactor tsk code lib: rename tsk internal function New API: internal_find_inode New API: find_inode find_inode: added API tests daemon/tsk.c | 157 ++++++++++++++++++++++++++++++------------- generator/actions.ml | 21 ++++++

v4: - refactor entry_is_dot My apologies for the duplicated submission but I did not read the next e-mail. The tsk_fs_dir_walk API will list all the entries including '.' and '..' in a similar manner as for 'ls -a'. This means our callback will be called for the following entries: . <-- the Root entry etc/. etc/.. <-- again the Root entry etc/systemd/.

v2: - refactor logic to reduce code duplication - better functions naming Matteo Cafasso (6): filesystem_walk: fixed root inode listing daemon: refactor tsk code lib: rename tsk internal function New API: internal_find_inode New API: find_inode find_inode: added API tests daemon/tsk.c | 156 ++++++++++++++++++++++++++++++------------- generator/actions.ml

v5: - small doc fix: filesystem_walk claimed '.' and '..' entries were not reported but Root is now reported as '.' - bump to 1.35.6 Matteo Cafasso (6): filesystem_walk: fixed root inode listing daemon: refactor tsk code lib: rename tsk internal function New API: internal_find_inode New API: find_inode find_inode: added API tests daemon/tsk.c