search for: tsk_flags

Already implemented entries. tsk_inode tsk_type tsk_size tsk_name tsk_flags Easy ones to add. tsk_atime_sec tsk_atime_nsec tsk_mtime_sec tsk_mtime_nsec tsk_ctime_sec tsk_ctime_nsec tsk_blksize tsk_blocks Further ideas. tsk_nlink tsk_link_name Signed-off-by: Matteo Cafasso <noxdafox@gmail.com> --- daemon/tsk.c | 4 +++- generator/structs.ml...

Report access, modification, status update and creation time in Unix format. Report number of links pointing to a given entry. If the entry is a symbolic link, report the path of its target. If the filesystem supports native/transparent compression, report compressed files with dedicated flag (DIRENT_COMPRESSED 0x04). Matteo Cafasso (2): filesystem_walk: more information into tsk_dirent

v8: - rebase on master - bump version to 1.33.37 - squash commits 1, 2, 3 Kept original commits messages when squashing them. Matteo Cafasso (3): New API: internal_filesystem_walk New API: filesystem_walk lib: Added filesystem_walk command tests daemon/Makefile.am | 4 +- daemon/tsk.c | 249 ++++++++++++++++++++++++++++++++++++++

...LK_ERROR; } + /* Set dirent fields */ + memset (&dirent, 0, sizeof dirent); + dirent.tsk_inode = fsfile->name->meta_addr; dirent.tsk_type = file_type (fsfile); - dirent.tsk_size = (fsfile->meta != NULL) ? fsfile->meta->size : -1; dirent.tsk_name = fname; dirent.tsk_flags = file_flags (fsfile); - dirent.tsk_spare1 = dirent.tsk_spare2 = dirent.tsk_spare3 = - dirent.tsk_spare4 = dirent.tsk_spare5 = dirent.tsk_spare6 = - dirent.tsk_spare7 = dirent.tsk_spare8 = dirent.tsk_spare9 = - dirent.tsk_spare10 = dirent.tsk_spare11 = 0; + + file_metadata (fsfile->me...

...LK_ERROR; } + /* Set dirent fields */ + memset (&dirent, 0, sizeof dirent); + dirent.tsk_inode = fsfile->name->meta_addr; dirent.tsk_type = file_type (fsfile); - dirent.tsk_size = (fsfile->meta != NULL) ? fsfile->meta->size : -1; dirent.tsk_name = fname; dirent.tsk_flags = file_flags (fsfile); - dirent.tsk_spare1 = dirent.tsk_spare2 = dirent.tsk_spare3 = - dirent.tsk_spare4 = dirent.tsk_spare5 = dirent.tsk_spare6 = - dirent.tsk_spare7 = dirent.tsk_spare8 = dirent.tsk_spare9 = - dirent.tsk_spare10 = dirent.tsk_spare11 = 0; + + ret = file_metadata (fsfile-...

v4: - Changed tsk_allocated struct field into tsk_flags. - Added optional dependency in documentation. - Use asprintf and perror instead of asprintf_nowarn and fprintf. - Ensure CLEANUP_FREE vars are initialised. - Reworked the function documentation. - Improved tests robustness. Matteo Cafasso (5): generator: Added tsk_dirent struct con...

v6: - added metadata reallocation flag in tsk_flags Certain filesystems separate file name structures and metadata ones. Therefore, deleted entries with file name structures in an unallocated state might point to metadata structures which have been reallocated to new files. A flag set to 1 is generally an indication that the informat...

...elds */ > + memset (&dirent, 0, sizeof dirent); > + > dirent.tsk_inode = fsfile->name->meta_addr; > dirent.tsk_type = file_type (fsfile); > dirent.tsk_size = (fsfile->meta != NULL) ? fsfile->meta->size : -1; > dirent.tsk_name = fname; > dirent.tsk_flags = file_flags (fsfile); > - dirent.tsk_spare1 = dirent.tsk_spare2 = dirent.tsk_spare3 = > - dirent.tsk_spare4 = dirent.tsk_spare5 = dirent.tsk_spare6 = > - dirent.tsk_spare7 = dirent.tsk_spare8 = dirent.tsk_spare9 = > - dirent.tsk_spare10 = dirent.tsk_spare11 = 0; > + > +...

v5: - fixed compile-time warning - removed unused flag enumeration - new version 1.33.19 Patch ready for review. Matteo Cafasso (5): generator: Added tsk_dirent struct configure: Added libtsk compile-time check New API: internal_filesystem_walk New API: filesystem_walk lib: Added filesystem_walk command tests daemon/Makefile.am | 4 +- daemon/tsk.c

The tsk_dirent struct contains the information gathered via TSK APIs. The struct contains the following fields: * tsk_inode: inode of a file * tsk_type: type of file such as for dirwalk command * tsk_size: file size in bytes * tsk_name: path relative to its disk partition * tsk_flags: bitfield containing extra information Signed-off-by: Matteo Cafasso <noxdafox@gmail.com> --- generator/structs.ml | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/generator/structs.ml b/generator/structs.ml index 6017ba6..4abb576 100644 --- a/generator/st...

...t directory entry information. *) > + { defaults with > + s_name = "tsk_dirent"; > + s_cols = [ > + "tsk_inode", FUInt64; > + "tsk_type", FChar; > + "tsk_size", FInt64; > + "tsk_name", FString; > + "tsk_flags", FUInt32; Note if you ever need to add more columns in future, you won't be able to, unless you reserve some space in the struct now by adding: "tsk_spare1", FInt64; "tsk_spare2", FInt64; "tsk_spare3", FInt64; "tsk_spare4", FInt64;...

...hanged, 22 insertions(+), 22 deletions(-) diff --git a/tests/tsk/test-filesystem-walk.sh b/tests/tsk/test-filesystem-walk.sh index 6ee3f71..d0f0df6 100755 --- a/tests/tsk/test-filesystem-walk.sh +++ b/tests/tsk/test-filesystem-walk.sh @@ -51,17 +51,17 @@ tsk_type: r tsk_size: .* tsk_name: \$MFT tsk_flags: 1 -tsk_spare1: 0 -tsk_spare2: 0 -tsk_spare3: 0 -tsk_spare4: 0 -tsk_spare5: 0 -tsk_spare6: 0 -tsk_spare7: 0 -tsk_spare8: 0 -tsk_spare9: 0 -tsk_spare10: 0 -tsk_spare11: 0 }' +tsk_atime_sec: .* +tsk_atime_nsec: .* +tsk_mtime_sec: .* +tsk_mtime_nsec: .* +tsk_ctime_sec: .* +tsk_ctime_nsec: .* +tsk_...

On Tue, Jun 28, 2016 at 10:49:16PM +0300, Matteo Cafasso wrote: > Already implemented entries. > > tsk_inode > tsk_type > tsk_size > tsk_name > tsk_flags > > Easy ones to add. > > tsk_atime_sec > tsk_atime_nsec > tsk_mtime_sec > tsk_mtime_nsec > tsk_ctime_sec > tsk_ctime_nsec > tsk_blksize > tsk_blocks > > Further ideas. > > tsk_nlink > tsk_link_name > > Signed-off-by: Matteo Cafasso <nox...

v7: - iterate over output file instead of reading it into memory Instead of reading the whole output file in memory and iterating over the resulting buffer, use XDR primitives to directly iterate over the file itself. This should reduce the API memory consumption. Patch ready for review. Code available at: https://github.com/noxdafox/libguestfs/tree/filesystem_walk Matteo Cafasso

...> + "tsk_type", FChar; > + "tsk_size", FInt64; > + "tsk_name", FString; > + "tsk_allocated", FUInt32; Once added to the public API, a struct cannot be extended anymore (it would break the ABI). IMHO it would make more sense to have a tsk_flags instead of tsk_allocated, documenting the values of the flags/bits set: this way, adding a new simple boolean flag won't require a new tsk_dirent2 (see e.g. the application2 struct). Thanks, -- Pino Toscano

...sh --ro -a ../../test-data/phony-guests/windows.img <<EOF +run +mount /dev/sda2 / +write /test.txt "foobar" +rm /test.txt +umount / +filesystem-walk /dev/sda2 +EOF +) + +# test $MFT is in the list +echo $output | grep -zq "{ tsk_inode: 0 tsk_type: r tsk_size: .* tsk_name: \$MFT tsk_flags: 1 }" +if [ $? != 0 ]; then + echo "$0: \$MFT not found in files list." + echo "File list:" + echo $output + exit 1 +fi + +# test deleted file is in the list +echo $output | grep -zq "{ tsk_inode: .* tsk_type: [ru] tsk_size: .* tsk_name: test.txt tsk_flags:...

v9: - add missing files: java/Makefile.inc, java/com/redhat/et/libguestfs/.gitignore, gobject/Makefile.inc - reserve space in tsk_dirent struct for future usage - use int instead of bool_t type - improve API documentation Matteo Cafasso (3): New API: internal_filesystem_walk New API: filesystem_walk lib: Added filesystem_walk command tests daemon/Makefile.am

On 28/06/16 23:01, Richard W.M. Jones wrote: > On Tue, Jun 28, 2016 at 10:49:16PM +0300, Matteo Cafasso wrote: >> Already implemented entries. >> >> tsk_inode >> tsk_type >> tsk_size >> tsk_name >> tsk_flags >> >> Easy ones to add. >> >> tsk_atime_sec >> tsk_atime_nsec >> tsk_mtime_sec >> tsk_mtime_nsec >> tsk_ctime_sec >> tsk_ctime_nsec >> tsk_blksize >> tsk_blocks >> >> Further ideas. >> >> tsk_nlink >> ts...

...LK_ERROR; } + /* Set dirent fields */ + memset (&dirent, 0, sizeof dirent); + dirent.tsk_inode = fsfile->name->meta_addr; dirent.tsk_type = file_type (fsfile); dirent.tsk_size = (fsfile->meta != NULL) ? fsfile->meta->size : -1; dirent.tsk_name = fname; dirent.tsk_flags = file_flags (fsfile); - dirent.tsk_spare1 = dirent.tsk_spare2 = dirent.tsk_spare3 = - dirent.tsk_spare4 = dirent.tsk_spare5 = dirent.tsk_spare6 = - dirent.tsk_spare7 = dirent.tsk_spare8 = dirent.tsk_spare9 = - dirent.tsk_spare10 = dirent.tsk_spare11 = 0; + + if (fsfile->meta != NULL)...

...tsk_dirent struct The tsk_dirent struct contains the information gathered via TSK APIs. The struct contains the following fields: * tsk_inode: inode of a file * tsk_type: type of file such as for dirwalk command * tsk_size: file size in bytes * tsk_name: path relative to its disk partition * tsk_flags: bitfield containing extra information - configure: Added libtsk compile-time check Ensure libtsk is available at compile time. If not, daemon routines depending on it won't be available. - API: internal_filesystem_walk The internal_filesystem_walk command walks through the FS structures...