search for: tsk_spare6

...walk_callback (TSK_FS_FILE *fsfile, const char *path, void *data) dirent.tsk_name = fname; dirent.tsk_flags = file_flags (fsfile); dirent.tsk_spare1 = dirent.tsk_spare2 = dirent.tsk_spare3 = - dirent.tsk_spare4 = dirent.tsk_spare5 = 0; + dirent.tsk_spare4 = dirent.tsk_spare5 = dirent.tsk_spare6 = + dirent.tsk_spare7 = dirent.tsk_spare8 = dirent.tsk_spare9 = + dirent.tsk_spare10 = dirent.tsk_spare11 = 0; ret = send_dirent_info (&dirent); ret = (ret == 0) ? TSK_WALK_CONT : TSK_WALK_ERROR; diff --git a/generator/structs.ml b/generator/structs.ml index acc0661..eb8931f 100644...

...E *fsfile, const char *path, void *data) > dirent.tsk_name = fname; > dirent.tsk_flags = file_flags (fsfile); > dirent.tsk_spare1 = dirent.tsk_spare2 = dirent.tsk_spare3 = > - dirent.tsk_spare4 = dirent.tsk_spare5 = 0; > + dirent.tsk_spare4 = dirent.tsk_spare5 = dirent.tsk_spare6 = > + dirent.tsk_spare7 = dirent.tsk_spare8 = dirent.tsk_spare9 = > + dirent.tsk_spare10 = dirent.tsk_spare11 = 0; > > ret = send_dirent_info (&dirent); > ret = (ret == 0) ? TSK_WALK_CONT : TSK_WALK_ERROR; > diff --git a/generator/structs.ml b/generator/structs.ml...

...path, void *data) >> dirent.tsk_name = fname; >> dirent.tsk_flags = file_flags (fsfile); >> dirent.tsk_spare1 = dirent.tsk_spare2 = dirent.tsk_spare3 = >> - dirent.tsk_spare4 = dirent.tsk_spare5 = 0; >> + dirent.tsk_spare4 = dirent.tsk_spare5 = dirent.tsk_spare6 = >> + dirent.tsk_spare7 = dirent.tsk_spare8 = dirent.tsk_spare9 = >> + dirent.tsk_spare10 = dirent.tsk_spare11 = 0; >> >> ret = send_dirent_info (&dirent); >> ret = (ret == 0) ? TSK_WALK_CONT : TSK_WALK_ERROR; >> diff --git a/generator/structs....

Report access, modification, status update and creation time in Unix format. Report number of links pointing to a given entry. If the entry is a symbolic link, report the path of its target. If the filesystem supports native/transparent compression, report compressed files with dedicated flag (DIRENT_COMPRESSED 0x04). Matteo Cafasso (2): filesystem_walk: more information into tsk_dirent

...nt.tsk_type = file_type (fsfile); - dirent.tsk_size = (fsfile->meta != NULL) ? fsfile->meta->size : -1; dirent.tsk_name = fname; dirent.tsk_flags = file_flags (fsfile); - dirent.tsk_spare1 = dirent.tsk_spare2 = dirent.tsk_spare3 = - dirent.tsk_spare4 = dirent.tsk_spare5 = dirent.tsk_spare6 = - dirent.tsk_spare7 = dirent.tsk_spare8 = dirent.tsk_spare9 = - dirent.tsk_spare10 = dirent.tsk_spare11 = 0; + + file_metadata (fsfile->meta, &dirent); ret = send_dirent_info (&dirent); ret = (ret == 0) ? TSK_WALK_CONT : TSK_WALK_ERROR; @@ -175,7 +177,7 @@ file_type (TSK_...

...nt.tsk_type = file_type (fsfile); - dirent.tsk_size = (fsfile->meta != NULL) ? fsfile->meta->size : -1; dirent.tsk_name = fname; dirent.tsk_flags = file_flags (fsfile); - dirent.tsk_spare1 = dirent.tsk_spare2 = dirent.tsk_spare3 = - dirent.tsk_spare4 = dirent.tsk_spare5 = dirent.tsk_spare6 = - dirent.tsk_spare7 = dirent.tsk_spare8 = dirent.tsk_spare9 = - dirent.tsk_spare10 = dirent.tsk_spare11 = 0; + + ret = file_metadata (fsfile->meta, &dirent); + if (ret < 0) + return TSK_WALK_ERROR; ret = send_dirent_info (&dirent); ret = (ret == 0) ? TSK_WALK_CONT...

...fsfile); > dirent.tsk_size = (fsfile->meta != NULL) ? fsfile->meta->size : -1; > dirent.tsk_name = fname; > dirent.tsk_flags = file_flags (fsfile); > - dirent.tsk_spare1 = dirent.tsk_spare2 = dirent.tsk_spare3 = > - dirent.tsk_spare4 = dirent.tsk_spare5 = dirent.tsk_spare6 = > - dirent.tsk_spare7 = dirent.tsk_spare8 = dirent.tsk_spare9 = > - dirent.tsk_spare10 = dirent.tsk_spare11 = 0; > + > + if (fsfile->meta != NULL) { > + dirent.tsk_nlink = fsfile->meta->nlink; > + dirent.tsk_atime_sec = fsfile->meta->atime; > +...

...o add more columns in future, you won't be able to, unless you reserve some space in the struct now by adding: "tsk_spare1", FInt64; "tsk_spare2", FInt64; "tsk_spare3", FInt64; "tsk_spare4", FInt64; "tsk_spare5", FInt64; "tsk_spare6", FInt64; I can't say if you'll need more columns here, or if the set you have now is the final set that you'll ever need. This patch looks OK to me. Rich. -- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones Read my programming and virtualization b...

...b/tests/tsk/test-filesystem-walk.sh index 6ee3f71..d0f0df6 100755 --- a/tests/tsk/test-filesystem-walk.sh +++ b/tests/tsk/test-filesystem-walk.sh @@ -51,17 +51,17 @@ tsk_type: r tsk_size: .* tsk_name: \$MFT tsk_flags: 1 -tsk_spare1: 0 -tsk_spare2: 0 -tsk_spare3: 0 -tsk_spare4: 0 -tsk_spare5: 0 -tsk_spare6: 0 -tsk_spare7: 0 -tsk_spare8: 0 -tsk_spare9: 0 -tsk_spare10: 0 -tsk_spare11: 0 }' +tsk_atime_sec: .* +tsk_atime_nsec: .* +tsk_mtime_sec: .* +tsk_mtime_nsec: .* +tsk_ctime_sec: .* +tsk_ctime_nsec: .* +tsk_crtime_sec: .* +tsk_crtime_nsec: .* +tsk_nlink: 1 +tsk_link: .*; +tsk_spare1: 0 }' if...

...nt.tsk_type = file_type (fsfile); dirent.tsk_size = (fsfile->meta != NULL) ? fsfile->meta->size : -1; dirent.tsk_name = fname; dirent.tsk_flags = file_flags (fsfile); - dirent.tsk_spare1 = dirent.tsk_spare2 = dirent.tsk_spare3 = - dirent.tsk_spare4 = dirent.tsk_spare5 = dirent.tsk_spare6 = - dirent.tsk_spare7 = dirent.tsk_spare8 = dirent.tsk_spare9 = - dirent.tsk_spare10 = dirent.tsk_spare11 = 0; + + if (fsfile->meta != NULL) { + dirent.tsk_nlink = fsfile->meta->nlink; + dirent.tsk_atime_sec = fsfile->meta->atime; + dirent.tsk_atime_nsec = fsfile->...

v8: - rebase on master - bump version to 1.33.37 - squash commits 1, 2, 3 Kept original commits messages when squashing them. Matteo Cafasso (3): New API: internal_filesystem_walk New API: filesystem_walk lib: Added filesystem_walk command tests daemon/Makefile.am | 4 +- daemon/tsk.c | 249 ++++++++++++++++++++++++++++++++++++++