search for: find_block

This series is ready for review but requires the previous one to be merged first: https://www.redhat.com/archives/libguestfs/2016-September/msg00101.html The find_block API allows the User to search all the filesystem entries referring to a given data block and returns a tsk_dirent structure for each of them. Use case examples: - Check whether a block containing a deleted file has been re-used to store a new one. - Map a certain area of a disk with the contain...

v3: - fixed attribute walk callback: checking against TSK_FS_BLOCK_FLAG_RAW flag would exclude compressed data blocks which are still important. Yet we want to exclude sparse blocks (TSK_FS_BLOCK_FLAG_SPARSE) as they are not stored on the disk. Matteo Cafasso (3): New API: internal_find_block New API: find_block find_block: added API tests daemon/tsk.c | 91 ++++++++++++++++++++++++++++++++++++++++++++ generator/actions.ml | 25 ++++++++++++ src/MAX_PROC_NR | 2 +- src/tsk.c | 17 +++++++++ tests/tsk/Makefile.am | 1...

v2: - use boolean field in struct - move refactoring to previous series Matteo Cafasso (3): New API: internal_find_block New API: find_block find_block: added API tests daemon/tsk.c | 90 ++++++++++++++++++++++++++++++++++++++++++++ generator/actions.ml | 25 ++++++++++++ src/MAX_PROC_NR | 2 +- src/tsk.c | 17 +++++++++ tests/tsk/Makefile.am | 1...

On Saturday, 8 October 2016 18:27:21 CEST Matteo Cafasso wrote: > Patch ready for merging. > > v4: > > - check return code of tsk_fs_attr_walk > - pass TSK_FS_FILE_WALK_FLAG_NOSPARSE as additional flag to > tsk_fs_attr_walk > > After discussing with TSK authors the behaviour is clear. [1] Thanks, this improves the situation a bit. > In case of COMPRESSED

...do not have to enforce the blocks to be RAW as we would be missing COMPRESSED ones (NTFS only). [1] https://github.com/sleuthkit/sleuthkit/pull/721 [2] http://www.sleuthkit.org/sleuthkit/docs/api-docs/4.2/group__fslib.html#ga3ce8349107b00e1b1502c86a5d6c0727 Matteo Cafasso (3): New API: internal_find_block New API: find_block find_block: added API tests daemon/tsk.c | 96 ++++++++++++++++++++++++++++++++++++++++++++ generator/actions.ml | 25 ++++++++++++ src/MAX_PROC_NR | 2 +- src/tsk.c | 17 ++++++++ tests/tsk/Makefile.am | 1 +...

...gic > > in a dedicated set of patches. > > The general idea looks ok, but I'd rather see the duplication dealt > with sooner than later. > In the previous submissions, non related changes were rejected therefore I thought that was the custom. Moreover I'll add another API find_block (block_number --> tsk_dirents referring to it) and I think is easier to refactor the code once all the use cases are in place as the picture gets more clear. > Thanks, > -- > Pino Toscano > _______________________________________________ > Libguestfs mailing list > Libguestfs...

...fopen (tmpfile, "r"); - if (fp == NULL) { - perrorf (g, "fopen: %s", tmpfile); - return NULL; - } - - return parse_dirent_file (g, fp); /* caller frees */ + return parse_dirent_file (g, tmpfile); /* caller frees */ } struct guestfs_tsk_dirent_list * guestfs_impl_find_block (guestfs_h *g, const char *mountable, int64_t block) { int ret = 0; - CLEANUP_FCLOSE FILE *fp = NULL; CLEANUP_UNLINK_FREE char *tmpfile = NULL; - ret = guestfs_int_lazy_make_tmpdir (g); - if (ret < 0) - return NULL; - - tmpfile = safe_asprintf (g, "%s/find_block%d", g-&g...

v7: - Merge src/tsk.c refactoring patch with #4 of find_block series Matteo Cafasso (4): lib: logic refactoring New API: internal_find_inode New API: find_inode find_inode: added API tests daemon/tsk.c | 52 ++++++++++++++++++++++++++++++++++ generator/actions.ml | 21 ++++++++++++++ src/MAX_PROC_NR | 2 +- src...

...d changes such as formatting fixes. I remember to have said that it's a no-go as *single* patch, but they can be sent (and integrated) as different commits. In this case, refactoring and de-duplication of code should be done in different commits as well. > Moreover I'll add another API find_block (block_number --> tsk_dirents > referring to it) and I think is easier to refactor the code once all the > use cases are in place as the picture gets more clear. More reasons to refactor *before*: since you already planned more APIs, it's easier to just refactor one in advance with al...

...919a0 zfs:zio_read_init+49 () genunix: [ID 655072 kern.notice] ffffff00100919d0 zfs:zio_execute+7f () genunix: [ID 655072 kern.notice] ffffff0010091a10 zfs:zio_wait+2e () genunix: [ID 655072 kern.notice] ffffff0010091a60 zfs:traverse_read+19f () genunix: [ID 655072 kern.notice] ffffff0010091b00 zfs:find_block+15b () genunix: [ID 655072 kern.notice] ffffff0010091b90 zfs:traverse_segment+233 () genunix: [ID 655072 kern.notice] ffffff0010091be0 zfs:traverse_more+6f () genunix: [ID 655072 kern.notice] ffffff0010091c60 zfs:spa_scrub_thread+19d () genunix: [ID 655072 kern.notice] ffffff0010091c70 unix:thread_...

The internal_find_block command searches all entries referring to the given filesystem data block and returns a tsk_dirent structure for each of them. For filesystems such as NTFS which do not delete the block mapping when removing files, it is possible to get multiple non-allocated entries for the same block. The gathe...

The internal_find_block command searches all entries referring to the given filesystem data block and returns a tsk_dirent structure for each of them. For filesystems such as NTFS which do not delete the block mapping when removing files, it is possible to get multiple non-allocated entries for the same block. The gathe...

The internal_find_block command searches all entries referring to the given filesystem data block and returns a tsk_dirent structure for each of them. For filesystems such as NTFS which do not delete the block mapping when removing files, it is possible to get multiple non-allocated entries for the same block. The gathe...

The find_inode API allows the User to search all the entries referring to a given inode and returns a tsk_dirent structure for each of them. As I didn't want to change unrelated code, there is a little bit of code duplication at the moment. Plan is to refactor the logic in a dedicated set of patches. Matteo Cafasso (3): New API: internal_find_inode New API: find_inode find_inode: added

This series should be ready for merge v6: - rebase on master - changes according to last comments Matteo Cafasso (6): filesystem_walk: fixed root inode listing daemon: refactor tsk code lib: rename tsk internal function New API: internal_find_inode New API: find_inode find_inode: added API tests daemon/tsk.c | 155 ++++++++++++++++++++++++++++++-------------