search for: findblk_data

...e_end (1); /* Cancel file transfer. */ > + > + fs->close (fs); > + img->close (img); > + > + return ret; > +} > + > + (One extra empty line.) > +static TSK_WALK_RET_ENUM > +findblk_callback (TSK_FS_FILE *fsfile, const char *path, void *data) > +{ > + findblk_data blkdata; > + const TSK_FS_ATTR *fsattr = NULL; > + int ret = 0, count = 0, index = 0; > + uint64_t *block = (uint64_t *) data; Just dereference the pointer directly, so it will not be needed later on: const uint64_t block = * (uint64_t *) data; Or, even better, this can be done onl...

...CONT on success, TSK_WALK_ERROR on error. > + */ > +static TSK_WALK_RET_ENUM > +attrwalk_callback (TSK_FS_FILE *fsfile, TSK_OFF_T offset, > + TSK_DADDR_T blkaddr, char *buf, size_t size, > + TSK_FS_BLOCK_FLAG_ENUM flags, void *data) > +{ > + findblk_data *blkdata = (findblk_data *) data; > + > + if (!(flags & TSK_FS_BLOCK_FLAG_SPARSE) && blkaddr == blkdata->block) { > + blkdata->found = true; If we want to ignore sparse blocks, wouldn't it make sense to pass TSK_FS_FILE_WALK_FLAG_NOSPARSE as additional flag to ts...

...| 2 +- 3 files changed, 99 insertions(+), 1 deletion(-) diff --git a/daemon/tsk.c b/daemon/tsk.c index af803d7..6ac3952 100644 --- a/daemon/tsk.c +++ b/daemon/tsk.c @@ -42,9 +42,16 @@ enum tsk_dirent_flags { DIRENT_COMPRESSED = 0x04 }; +typedef struct { + int found; + uint64_t block; +} findblk_data; + static int open_filesystem (const char *, TSK_IMG_INFO **, TSK_FS_INFO **); static TSK_WALK_RET_ENUM fswalk_callback (TSK_FS_FILE *, const char *, void *); static TSK_WALK_RET_ENUM findino_callback (TSK_FS_FILE *, const char *, void *); +static TSK_WALK_RET_ENUM findblk_callback (TSK_FS_FILE...

...@@ #include <stdio.h> #include <stdlib.h> +#include <stdbool.h> #include <inttypes.h> #include <string.h> #include <unistd.h> @@ -42,9 +43,16 @@ enum tsk_dirent_flags { DIRENT_COMPRESSED = 0x04 }; +typedef struct { + bool found; + uint64_t block; +} findblk_data; + static int open_filesystem (const char *, TSK_IMG_INFO **, TSK_FS_INFO **); static TSK_WALK_RET_ENUM fswalk_callback (TSK_FS_FILE *, const char *, void *); static TSK_WALK_RET_ENUM findino_callback (TSK_FS_FILE *, const char *, void *); +static TSK_WALK_RET_ENUM findblk_callback (TSK_FS_FILE...

...@@ #include <stdio.h> #include <stdlib.h> +#include <stdbool.h> #include <inttypes.h> #include <string.h> #include <unistd.h> @@ -42,9 +43,16 @@ enum tsk_dirent_flags { DIRENT_COMPRESSED = 0x04 }; +typedef struct { + bool found; + uint64_t block; +} findblk_data; + static int open_filesystem (const char *, TSK_IMG_INFO **, TSK_FS_INFO **); static TSK_WALK_RET_ENUM fswalk_callback (TSK_FS_FILE *, const char *, void *); static TSK_WALK_RET_ENUM findino_callback (TSK_FS_FILE *, const char *, void *); +static TSK_WALK_RET_ENUM findblk_callback (TSK_FS_FILE...

v2: - use boolean field in struct - move refactoring to previous series Matteo Cafasso (3): New API: internal_find_block New API: find_block find_block: added API tests daemon/tsk.c | 90 ++++++++++++++++++++++++++++++++++++++++++++ generator/actions.ml | 25 ++++++++++++ src/MAX_PROC_NR | 2 +- src/tsk.c | 17 +++++++++

v3: - fixed attribute walk callback: checking against TSK_FS_BLOCK_FLAG_RAW flag would exclude compressed data blocks which are still important. Yet we want to exclude sparse blocks (TSK_FS_BLOCK_FLAG_SPARSE) as they are not stored on the disk. Matteo Cafasso (3): New API: internal_find_block New API: find_block find_block: added API tests daemon/tsk.c | 91

This series is ready for review but requires the previous one to be merged first: https://www.redhat.com/archives/libguestfs/2016-September/msg00101.html The find_block API allows the User to search all the filesystem entries referring to a given data block and returns a tsk_dirent structure for each of them. Use case examples: - Check whether a block containing a deleted file has been re-used

Patch ready for merging. v4: - check return code of tsk_fs_attr_walk - pass TSK_FS_FILE_WALK_FLAG_NOSPARSE as additional flag to tsk_fs_attr_walk After discussing with TSK authors the behaviour is clear. [1] In case of COMPRESSED blocks, the callback will be called for all the attributes no matter whether they are on disk or not (sparse). In such cases, the block address will be 0. [2] So