search for: tsk_spare10

Displaying 9 results from an estimated 9 matches for "tsk_spare10".

Did you mean: tsk_spare1
2016 Jun 28
2
[PATCH] Reserve entries to tsk_dirent struct
...me; dirent.tsk_flags = file_flags (fsfile); dirent.tsk_spare1 = dirent.tsk_spare2 = dirent.tsk_spare3 = - dirent.tsk_spare4 = dirent.tsk_spare5 = 0; + dirent.tsk_spare4 = dirent.tsk_spare5 = dirent.tsk_spare6 = + dirent.tsk_spare7 = dirent.tsk_spare8 = dirent.tsk_spare9 = + dirent.tsk_spare10 = dirent.tsk_spare11 = 0; ret = send_dirent_info (&dirent); ret = (ret == 0) ? TSK_WALK_CONT : TSK_WALK_ERROR; diff --git a/generator/structs.ml b/generator/structs.ml index acc0661..eb8931f 100644 --- a/generator/structs.ml +++ b/generator/structs.ml @@ -459,6 +459,12 @@ let structs = [...
2016 Jun 28
0
Re: [PATCH] Reserve entries to tsk_dirent struct
...file_flags (fsfile); > dirent.tsk_spare1 = dirent.tsk_spare2 = dirent.tsk_spare3 = > - dirent.tsk_spare4 = dirent.tsk_spare5 = 0; > + dirent.tsk_spare4 = dirent.tsk_spare5 = dirent.tsk_spare6 = > + dirent.tsk_spare7 = dirent.tsk_spare8 = dirent.tsk_spare9 = > + dirent.tsk_spare10 = dirent.tsk_spare11 = 0; > > ret = send_dirent_info (&dirent); > ret = (ret == 0) ? TSK_WALK_CONT : TSK_WALK_ERROR; > diff --git a/generator/structs.ml b/generator/structs.ml > index acc0661..eb8931f 100644 > --- a/generator/structs.ml > +++ b/generator/structs.ml &...
2016 Jun 28
1
Re: [PATCH] Reserve entries to tsk_dirent struct
...>> dirent.tsk_spare1 = dirent.tsk_spare2 = dirent.tsk_spare3 = >> - dirent.tsk_spare4 = dirent.tsk_spare5 = 0; >> + dirent.tsk_spare4 = dirent.tsk_spare5 = dirent.tsk_spare6 = >> + dirent.tsk_spare7 = dirent.tsk_spare8 = dirent.tsk_spare9 = >> + dirent.tsk_spare10 = dirent.tsk_spare11 = 0; >> >> ret = send_dirent_info (&dirent); >> ret = (ret == 0) ? TSK_WALK_CONT : TSK_WALK_ERROR; >> diff --git a/generator/structs.ml b/generator/structs.ml >> index acc0661..eb8931f 100644 >> --- a/generator/structs.ml >>...
2016 Jul 03
4
[PATCH 0/2] More information reported by filesystem_walk
Report access, modification, status update and creation time in Unix format. Report number of links pointing to a given entry. If the entry is a symbolic link, report the path of its target. If the filesystem supports native/transparent compression, report compressed files with dedicated flag (DIRENT_COMPRESSED 0x04). Matteo Cafasso (2): filesystem_walk: more information into tsk_dirent
2016 Jul 07
1
[PATCH] filesystem_walk: more information into tsk_dirent
...>meta->size : -1; dirent.tsk_name = fname; dirent.tsk_flags = file_flags (fsfile); - dirent.tsk_spare1 = dirent.tsk_spare2 = dirent.tsk_spare3 = - dirent.tsk_spare4 = dirent.tsk_spare5 = dirent.tsk_spare6 = - dirent.tsk_spare7 = dirent.tsk_spare8 = dirent.tsk_spare9 = - dirent.tsk_spare10 = dirent.tsk_spare11 = 0; + + file_metadata (fsfile->meta, &dirent); ret = send_dirent_info (&dirent); ret = (ret == 0) ? TSK_WALK_CONT : TSK_WALK_ERROR; @@ -175,7 +177,7 @@ file_type (TSK_FS_FILE *fsfile) return 'u'; } -/* Inspect fsfile to retrieve the file allocat...
2016 Jul 04
1
[PATCH] filesystem_walk: more information into tsk_dirent
...>meta->size : -1; dirent.tsk_name = fname; dirent.tsk_flags = file_flags (fsfile); - dirent.tsk_spare1 = dirent.tsk_spare2 = dirent.tsk_spare3 = - dirent.tsk_spare4 = dirent.tsk_spare5 = dirent.tsk_spare6 = - dirent.tsk_spare7 = dirent.tsk_spare8 = dirent.tsk_spare9 = - dirent.tsk_spare10 = dirent.tsk_spare11 = 0; + + ret = file_metadata (fsfile->meta, &dirent); + if (ret < 0) + return TSK_WALK_ERROR; ret = send_dirent_info (&dirent); ret = (ret == 0) ? TSK_WALK_CONT : TSK_WALK_ERROR; + if (strlen(dirent.tsk_link) == 0) + free (dirent.tsk_link); + r...
2016 Jul 04
1
Re: [PATCH 1/2] filesystem_walk: more information into tsk_dirent
...dirent.tsk_name = fname; > dirent.tsk_flags = file_flags (fsfile); > - dirent.tsk_spare1 = dirent.tsk_spare2 = dirent.tsk_spare3 = > - dirent.tsk_spare4 = dirent.tsk_spare5 = dirent.tsk_spare6 = > - dirent.tsk_spare7 = dirent.tsk_spare8 = dirent.tsk_spare9 = > - dirent.tsk_spare10 = dirent.tsk_spare11 = 0; > + > + if (fsfile->meta != NULL) { > + dirent.tsk_nlink = fsfile->meta->nlink; > + dirent.tsk_atime_sec = fsfile->meta->atime; > + dirent.tsk_atime_nsec = fsfile->meta->atime_nano; > + dirent.tsk_mtime_sec = fsfile->m...
2016 Jul 03
0
[PATCH 2/2] filesystem_walk: update tests
...100755 --- a/tests/tsk/test-filesystem-walk.sh +++ b/tests/tsk/test-filesystem-walk.sh @@ -51,17 +51,17 @@ tsk_type: r tsk_size: .* tsk_name: \$MFT tsk_flags: 1 -tsk_spare1: 0 -tsk_spare2: 0 -tsk_spare3: 0 -tsk_spare4: 0 -tsk_spare5: 0 -tsk_spare6: 0 -tsk_spare7: 0 -tsk_spare8: 0 -tsk_spare9: 0 -tsk_spare10: 0 -tsk_spare11: 0 }' +tsk_atime_sec: .* +tsk_atime_nsec: .* +tsk_mtime_sec: .* +tsk_mtime_nsec: .* +tsk_ctime_sec: .* +tsk_ctime_nsec: .* +tsk_crtime_sec: .* +tsk_crtime_nsec: .* +tsk_nlink: 1 +tsk_link: .*; +tsk_spare1: 0 }' if [ $? != 0 ]; then echo "$0: \$MFT not found in fil...
2016 Jul 03
0
[PATCH 1/2] filesystem_walk: more information into tsk_dirent
...>meta->size : -1; dirent.tsk_name = fname; dirent.tsk_flags = file_flags (fsfile); - dirent.tsk_spare1 = dirent.tsk_spare2 = dirent.tsk_spare3 = - dirent.tsk_spare4 = dirent.tsk_spare5 = dirent.tsk_spare6 = - dirent.tsk_spare7 = dirent.tsk_spare8 = dirent.tsk_spare9 = - dirent.tsk_spare10 = dirent.tsk_spare11 = 0; + + if (fsfile->meta != NULL) { + dirent.tsk_nlink = fsfile->meta->nlink; + dirent.tsk_atime_sec = fsfile->meta->atime; + dirent.tsk_atime_nsec = fsfile->meta->atime_nano; + dirent.tsk_mtime_sec = fsfile->meta->mtime; + dirent.tsk...