search for: internalmount

...ucts.ml b/generator/structs.ml > index 6017ba6..d986fd9 100644 > --- a/generator/structs.ml > +++ b/generator/structs.ml > @@ -442,8 +442,20 @@ let structs = [ > "im_device", FString; > "im_volume", FString; > ]; > - s_camel_name = "InternalMountable"; > - }; > + s_camel_name = "InternalMountable" }; Unneeded change. > + (* The Sleuth Kit directory entry information. *) > + { defaults with > + s_name = "tsk_dirent"; > + s_cols = [ > + "tsk_inode", FUInt64; > + &q...

...deletions(-) diff --git a/generator/structs.ml b/generator/structs.ml index 6017ba6..d986fd9 100644 --- a/generator/structs.ml +++ b/generator/structs.ml @@ -442,8 +442,20 @@ let structs = [ "im_device", FString; "im_volume", FString; ]; - s_camel_name = "InternalMountable"; - }; + s_camel_name = "InternalMountable" }; + + (* The Sleuth Kit directory entry information. *) + { defaults with + s_name = "tsk_dirent"; + s_cols = [ + "tsk_inode", FUInt64; + "tsk_type", FChar; + "tsk_size", FIn...

...13, 2016 at 07:50:52PM +0300, Matteo Cafasso wrote: > diff --git a/generator/structs.ml b/generator/structs.ml > index 6017ba6..3c2cc61 100644 > --- a/generator/structs.ml > +++ b/generator/structs.ml > @@ -444,6 +444,19 @@ let structs = [ > ]; > s_camel_name = "InternalMountable"; > }; > + > + (* The Sleuth Kit directory entry information. *) > + { defaults with > + s_name = "tsk_dirent"; > + s_cols = [ > + "tsk_inode", FUInt64; > + "tsk_type", FChar; > + "tsk_size", FInt64; &gt...

...in guestfish. diff --git a/generator/structs.ml b/generator/structs.ml index 6017ba6..9d2f309 100644 --- a/generator/structs.ml +++ b/generator/structs.ml @@ -442,8 +442,18 @@ let structs = [ "im_device", FString; "im_volume", FString; ]; - s_camel_name = "InternalMountable"; - }; + s_camel_name = "InternalMountable" }; + + (* The Sleuth Kit node info struct. *) + { defaults with + s_name = "tsk_node"; + s_cols = [ + "tsk_name", FString; + "tsk_inode", FUInt64; + "tsk_allocated", FUInt32;...

The ffind API allows to retrieve a file name from a device given its inode. The function returns a struct "tsknode" which contains the file name, its inode and it's allocation status. The struct will be employed by other APIs as well (fls, ifind etc..). $ ./run guestfish --ro -a /home/noxdafox/disks/ubuntu.qcow2 ><fs> run ><fs> ffind /dev/sda1 2 tsk_name: /

...deletion(-) diff --git a/generator/structs.ml b/generator/structs.ml index 6017ba6..4abb576 100644 --- a/generator/structs.ml +++ b/generator/structs.ml @@ -442,8 +442,21 @@ let structs = [ "im_device", FString; "im_volume", FString; ]; s_camel_name = "InternalMountable"; }; + + (* The Sleuth Kit directory entry information. *) + { defaults with + s_name = "tsk_dirent"; + s_cols = [ + "tsk_inode", FUInt64; + "tsk_type", FChar; + "tsk_size", FInt64; + "tsk_name", FString; + "t...

v3: - File size will be reported as - 1 if it cannot be retrieved. - Code improvements based on comments. Matteo Cafasso (5): generator: Added tsk_dirent struct configure: Added libtsk compile-time check daemon: Added internal_filesystem_walk command appliance: Added filesystem_walk command appliance: Added filesystem_walk command tests daemon/Makefile.am | 4 +-

...filesystem_walk." }; + ] (* Non-API meta-commands available only in guestfish. diff --git a/generator/structs.ml b/generator/structs.ml index 6017ba6..3c2cc61 100644 --- a/generator/structs.ml +++ b/generator/structs.ml @@ -444,6 +444,19 @@ let structs = [ ]; s_camel_name = "InternalMountable"; }; + + (* The Sleuth Kit directory entry information. *) + { defaults with + s_name = "tsk_dirent"; + s_cols = [ + "tsk_inode", FUInt64; + "tsk_type", FChar; + "tsk_size", FInt64; + "tsk_name", FString; + "t...

v8: - rebase on master - bump version to 1.33.37 - squash commits 1, 2, 3 Kept original commits messages when squashing them. Matteo Cafasso (3): New API: internal_filesystem_walk New API: filesystem_walk lib: Added filesystem_walk command tests daemon/Makefile.am | 4 +- daemon/tsk.c | 249 ++++++++++++++++++++++++++++++++++++++

v2: - Increased the amount of collected information from the FS content. - Moved filesystem_walk0 as internal command. - Code improvement based on comments. - Adhere to project's coding style. - Better command documentation. - More robust tests. Patch ready for review, code available at: https://github.com/noxdafox/libguestfs/tree/filesystem_walk Matteo Cafasso (5): generator:

v5: - fixed compile-time warning - removed unused flag enumeration - new version 1.33.19 Patch ready for review. Matteo Cafasso (5): generator: Added tsk_dirent struct configure: Added libtsk compile-time check New API: internal_filesystem_walk New API: filesystem_walk lib: Added filesystem_walk command tests daemon/Makefile.am | 4 +- daemon/tsk.c

v4: - Changed tsk_allocated struct field into tsk_flags. - Added optional dependency in documentation. - Use asprintf and perror instead of asprintf_nowarn and fprintf. - Ensure CLEANUP_FREE vars are initialised. - Reworked the function documentation. - Improved tests robustness. Matteo Cafasso (5): generator: Added tsk_dirent struct configure: Added libtsk compile-time check

v6: - added metadata reallocation flag in tsk_flags Certain filesystems separate file name structures and metadata ones. Therefore, deleted entries with file name structures in an unallocated state might point to metadata structures which have been reallocated to new files. A flag set to 1 is generally an indication that the information gathered from the metadata structure (file

v7: - iterate over output file instead of reading it into memory Instead of reading the whole output file in memory and iterating over the resulting buffer, use XDR primitives to directly iterate over the file itself. This should reduce the API memory consumption. Patch ready for review. Code available at: https://github.com/noxdafox/libguestfs/tree/filesystem_walk Matteo Cafasso

v9: - add missing files: java/Makefile.inc, java/com/redhat/et/libguestfs/.gitignore, gobject/Makefile.inc - reserve space in tsk_dirent struct for future usage - use int instead of bool_t type - improve API documentation Matteo Cafasso (3): New API: internal_filesystem_walk New API: filesystem_walk lib: Added filesystem_walk command tests daemon/Makefile.am