search for: parse_ffind

...NR | 2 +- 4 files changed, 93 insertions(+), 3 deletions(-) diff --git a/daemon/tsk.c b/daemon/tsk.c index a00f3ee..b84dfae 100644 --- a/daemon/tsk.c +++ b/daemon/tsk.c @@ -30,6 +30,7 @@ #include "optgroups.h" static int file_out (const char *cmd); +static guestfs_int_tsk_node* parse_ffind (const char *out, int64_t inode); GUESTFSD_EXT_CMD(str_sleuthkit_probe, icat); @@ -113,6 +114,65 @@ do_blkls (const mountable_t *mountable, int64_t start, int64_t stop) return file_out (cmd); } +guestfs_int_tsk_node* +do_find_inode (const mountable_t *mountable, int64_t inode) +{ + int r;...

The ffind API allows to retrieve a file name from a device given its inode. The function returns a struct "tsknode" which contains the file name, its inode and it's allocation status. The struct will be employed by other APIs as well (fls, ifind etc..). $ ./run guestfish --ro -a /home/noxdafox/disks/ubuntu.qcow2 ><fs> run ><fs> ffind /dev/sda1 2 tsk_name: /

...ath, void *data); +static char *join_path(const char *path, const char *name); +static int inode_out(guestfs_int_tsk_node *node_info); +static void reply_with_tsk_error(void); + +#else + +OPTGROUP_LIBTSK_NOT_AVAILABLE + +#endif + static int file_out (const char *cmd); static guestfs_int_tsk_node* parse_ffind (const char *out, int64_t inode); @@ -226,3 +246,169 @@ file_out (const char *cmd) return 0; } + +#ifdef HAVE_LIBTSK + + +int optgroup_libtsk_available(void) +{ + return 1; +} + +int do_filesystem_walk0(const mountable_t *mountable) +{ + int ret = 0; + TSK_FS_INFO *fs = NULL; + TSK_IMG_IN...

The filesystem_walk0 API parses the FS internals of a partition and returns a list of all the files and directories contained within. It list deleted files and directories as well. For each node, it reports its relative path, its inode and its allocation status. The output is serialised in XDR format and written to the given file. The command is similar to The Sleuth Kit "fls -rp