Displaying 9 results from an estimated 9 matches for "tsk_fs_block_flag_enum".
2016 Sep 23
1
Re: [PATCH v3 1/3] New API: internal_find_block
...the FS node attributes.
> + *
> + * Return TSK_WALK_CONT on success, TSK_WALK_ERROR on error.
> + */
> +static TSK_WALK_RET_ENUM
> +attrwalk_callback (TSK_FS_FILE *fsfile, TSK_OFF_T offset,
> + TSK_DADDR_T blkaddr, char *buf, size_t size,
> + TSK_FS_BLOCK_FLAG_ENUM flags, void *data)
> +{
> + findblk_data *blkdata = (findblk_data *) data;
> +
> + if (!(flags & TSK_FS_BLOCK_FLAG_SPARSE) && blkaddr == blkdata->block) {
> + blkdata->found = true;
If we want to ignore sparse blocks, wouldn't it make sense to pass
TSK_FS_...
2016 Sep 17
0
[PATCH 1/4] New API: internal_find_block
...S_FILE *, const char *, void *);
static TSK_WALK_RET_ENUM findino_callback (TSK_FS_FILE *, const char *, void *);
+static TSK_WALK_RET_ENUM findblk_callback (TSK_FS_FILE *, const char *, void *);
+static TSK_WALK_RET_ENUM attrwalk_callback (TSK_FS_FILE *, TSK_OFF_T , TSK_DADDR_T , char *, size_t , TSK_FS_BLOCK_FLAG_ENUM , void *);
static int send_dirent_info (TSK_FS_FILE *, const char *);
static char file_type (TSK_FS_FILE *);
static int file_flags (TSK_FS_FILE *fsfile);
@@ -109,6 +116,36 @@ do_internal_find_inode (const mountable_t *mountable, int64_t inode)
return ret;
}
+int
+do_internal_find_block (con...
2016 Sep 19
0
[PATCH v2 1/3] New API: internal_find_block
...S_FILE *, const char *, void *);
static TSK_WALK_RET_ENUM findino_callback (TSK_FS_FILE *, const char *, void *);
+static TSK_WALK_RET_ENUM findblk_callback (TSK_FS_FILE *, const char *, void *);
+static TSK_WALK_RET_ENUM attrwalk_callback (TSK_FS_FILE *, TSK_OFF_T , TSK_DADDR_T , char *, size_t , TSK_FS_BLOCK_FLAG_ENUM , void *);
static int send_dirent_info (TSK_FS_FILE *, const char *);
static char file_type (TSK_FS_FILE *);
static int file_flags (TSK_FS_FILE *fsfile);
@@ -109,6 +117,36 @@ do_internal_find_inode (const mountable_t *mountable, int64_t inode)
return ret;
}
+int
+do_internal_find_block (con...
2016 Sep 20
0
[PATCH v3 1/3] New API: internal_find_block
...S_FILE *, const char *, void *);
static TSK_WALK_RET_ENUM findino_callback (TSK_FS_FILE *, const char *, void *);
+static TSK_WALK_RET_ENUM findblk_callback (TSK_FS_FILE *, const char *, void *);
+static TSK_WALK_RET_ENUM attrwalk_callback (TSK_FS_FILE *, TSK_OFF_T , TSK_DADDR_T , char *, size_t , TSK_FS_BLOCK_FLAG_ENUM , void *);
static int send_dirent_info (TSK_FS_FILE *, const char *);
static char file_type (TSK_FS_FILE *);
static int file_flags (TSK_FS_FILE *fsfile);
@@ -109,6 +117,35 @@ do_internal_find_inode (const mountable_t *mountable, int64_t inode)
return ret;
}
+int
+do_internal_find_block (con...
2016 Sep 20
5
[PATCH v3 0/3] New API - find_block
v3:
- fixed attribute walk callback: checking against TSK_FS_BLOCK_FLAG_RAW flag would
exclude compressed data blocks which are still important.
Yet we want to exclude sparse blocks (TSK_FS_BLOCK_FLAG_SPARSE) as they are not stored
on the disk.
Matteo Cafasso (3):
New API: internal_find_block
New API: find_block
find_block: added API tests
daemon/tsk.c | 91
2016 Sep 20
1
Re: [PATCH v2 1/3] New API: internal_find_block
...block within the FS node attributes. */
Even if within 80 columns, I'd split it at 70 for readability.
> +static TSK_WALK_RET_ENUM
> +attrwalk_callback (TSK_FS_FILE *fsfile, TSK_OFF_T offset,
> + TSK_DADDR_T blkaddr, char *buf, size_t size,
> + TSK_FS_BLOCK_FLAG_ENUM flags, void *data)
> +{
> + findblk_data *blkdata = (findblk_data *) data;
> +
> + if (blkaddr == blkdata->block) {
> + blkdata->found = true;
If I read the sleuthkit API docs, blkaddr will be meaningful only if
flags contains TSK_FS_BLOCK_FLAG_RAW. Should attrwalk_callb...
2016 Sep 19
5
[PATCH v2 0/3] New API - find_block
v2:
- use boolean field in struct
- move refactoring to previous series
Matteo Cafasso (3):
New API: internal_find_block
New API: find_block
find_block: added API tests
daemon/tsk.c | 90 ++++++++++++++++++++++++++++++++++++++++++++
generator/actions.ml | 25 ++++++++++++
src/MAX_PROC_NR | 2 +-
src/tsk.c | 17 +++++++++
2016 Oct 08
5
[PATCH v4 0/3] New API - find_block
Patch ready for merging.
v4:
- check return code of tsk_fs_attr_walk
- pass TSK_FS_FILE_WALK_FLAG_NOSPARSE as additional flag to tsk_fs_attr_walk
After discussing with TSK authors the behaviour is clear. [1]
In case of COMPRESSED blocks, the callback will be called for all the attributes no matter whether they are on disk or not (sparse). In such cases, the block address will be 0. [2]
So
2016 Sep 17
7
[PATCH 0/4] New API - find_block
This series is ready for review but requires the previous one to be merged first:
https://www.redhat.com/archives/libguestfs/2016-September/msg00101.html
The find_block API allows the User to search all the filesystem entries
referring to a given data block and returns a tsk_dirent structure
for each of them.
Use case examples:
- Check whether a block containing a deleted file has been re-used