search for: tsk_fs_file_walk_flag_nosparse

...AG_ENUM flags, void *data) > +{ > + findblk_data *blkdata = (findblk_data *) data; > + > + if (!(flags & TSK_FS_BLOCK_FLAG_SPARSE) && blkaddr == blkdata->block) { > + blkdata->found = true; If we want to ignore sparse blocks, wouldn't it make sense to pass TSK_FS_FILE_WALK_FLAG_NOSPARSE as additional flag to tsk_fs_attr_walk above? Also, my concerns about this that I replied in v2 still stand: is the documentation obsolete, or does it document what is the expected behaviour? In the former case, then it could be ok to partially disregard what it said; in the latter, the code shoul...

Patch ready for merging. v4: - check return code of tsk_fs_attr_walk - pass TSK_FS_FILE_WALK_FLAG_NOSPARSE as additional flag to tsk_fs_attr_walk After discussing with TSK authors the behaviour is clear. [1] In case of COMPRESSED blocks, the callback will be called for all the attributes no matter whether they are on disk or not (sparse). In such cases, the block address will be 0. [2] So we do not h...

On Saturday, 8 October 2016 18:27:21 CEST Matteo Cafasso wrote: > Patch ready for merging. > > v4: > > - check return code of tsk_fs_attr_walk > - pass TSK_FS_FILE_WALK_FLAG_NOSPARSE as additional flag to > tsk_fs_attr_walk > > After discussing with TSK authors the behaviour is clear. [1] Thanks, this improves the situation a bit. > In case of COMPRESSED blocks, the callback will be called for all the > attributes no matter whether they are on disk or not (sp...

v3: - fixed attribute walk callback: checking against TSK_FS_BLOCK_FLAG_RAW flag would exclude compressed data blocks which are still important. Yet we want to exclude sparse blocks (TSK_FS_BLOCK_FLAG_SPARSE) as they are not stored on the disk. Matteo Cafasso (3): New API: internal_find_block New API: find_block find_block: added API tests daemon/tsk.c | 91