search for: tsk_node

Renamed ffind API to find_inode. Renamed tsknode struct to tsk_node. Changed struct field from int64 to uint64. As pointed out on IRC it would be better to agree on some naming convention. One option would be to prefix all the forensics APIs with tsk_ as TSK (The Sleuth Kit) is the main tool used for implementing them. Other option could be giving generic names al...

The filesystem_walk API parses the FS internals of a partition and returns a list of all the files and directories contained within. It list deleted files and directories as well. For each node, it reports its relative path, its inode and its allocation status. This is the end user API for inspecting a disk partition content. The command can handle filenames with special characters. Example

...<rpc/types.h> + +static int +open_filesystem(const char *device, TSK_IMG_INFO **img, TSK_FS_INFO **fs); +static TSK_WALK_RET_ENUM +fswalk_callback(TSK_FS_FILE *fsfile, const char *path, void *data); +static char *join_path(const char *path, const char *name); +static int inode_out(guestfs_int_tsk_node *node_info); +static void reply_with_tsk_error(void); + +#else + +OPTGROUP_LIBTSK_NOT_AVAILABLE + +#endif + static int file_out (const char *cmd); static guestfs_int_tsk_node* parse_ffind (const char *out, int64_t inode); @@ -226,3 +246,169 @@ file_out (const char *cmd) return 0; } + +#ifde...

...e C<XDG_RUNTIME_DIR> controls the default value: If C<XDG_RUNTIME_DIR> is set, then that is the default. Else F</tmp> is the default." }; + { defaults with + name = "filesystem_walk"; added = (1, 33, 16); + style = RStructList ("nodeinfos", "tsk_node"), [Mountable "device";], []; + optional = Some "libtsk"; + progress = true; cancellable = true; + shortdesc = "walk through the filesystem content"; + longdesc = "\ +Walk through the internal structures of a disk partition (eg. F</dev/sda1>...

The filesystem_walk0 API parses the FS internals of a partition and returns a list of all the files and directories contained within. It list deleted files and directories as well. For each node, it reports its relative path, its inode and its allocation status. The output is serialised in XDR format and written to the given file. The command is similar to The Sleuth Kit "fls -rp