search for: tsk_walk_ret_enum

...index af803d7..6ac3952 100644 --- a/daemon/tsk.c +++ b/daemon/tsk.c @@ -42,9 +42,16 @@ enum tsk_dirent_flags { DIRENT_COMPRESSED = 0x04 }; +typedef struct { + int found; + uint64_t block; +} findblk_data; + static int open_filesystem (const char *, TSK_IMG_INFO **, TSK_FS_INFO **); static TSK_WALK_RET_ENUM fswalk_callback (TSK_FS_FILE *, const char *, void *); static TSK_WALK_RET_ENUM findino_callback (TSK_FS_FILE *, const char *, void *); +static TSK_WALK_RET_ENUM findblk_callback (TSK_FS_FILE *, const char *, void *); +static TSK_WALK_RET_ENUM attrwalk_callback (TSK_FS_FILE *, TSK_OFF_T , TSK_DADD...

...nttypes.h> #include <string.h> #include <unistd.h> @@ -42,9 +43,16 @@ enum tsk_dirent_flags { DIRENT_COMPRESSED = 0x04 }; +typedef struct { + bool found; + uint64_t block; +} findblk_data; + static int open_filesystem (const char *, TSK_IMG_INFO **, TSK_FS_INFO **); static TSK_WALK_RET_ENUM fswalk_callback (TSK_FS_FILE *, const char *, void *); static TSK_WALK_RET_ENUM findino_callback (TSK_FS_FILE *, const char *, void *); +static TSK_WALK_RET_ENUM findblk_callback (TSK_FS_FILE *, const char *, void *); +static TSK_WALK_RET_ENUM attrwalk_callback (TSK_FS_FILE *, TSK_OFF_T , TSK_DADD...

...nttypes.h> #include <string.h> #include <unistd.h> @@ -42,9 +43,16 @@ enum tsk_dirent_flags { DIRENT_COMPRESSED = 0x04 }; +typedef struct { + bool found; + uint64_t block; +} findblk_data; + static int open_filesystem (const char *, TSK_IMG_INFO **, TSK_FS_INFO **); static TSK_WALK_RET_ENUM fswalk_callback (TSK_FS_FILE *, const char *, void *); static TSK_WALK_RET_ENUM findino_callback (TSK_FS_FILE *, const char *, void *); +static TSK_WALK_RET_ENUM findblk_callback (TSK_FS_FILE *, const char *, void *); +static TSK_WALK_RET_ENUM attrwalk_callback (TSK_FS_FILE *, TSK_OFF_T , TSK_DADD...

..., 1 deletion(-) > > diff --git a/daemon/tsk.c b/daemon/tsk.c > index dd368d7..beb92a3 100644 > --- a/daemon/tsk.c > +++ b/daemon/tsk.c > @@ -44,6 +44,7 @@ enum tsk_dirent_flags { > > static int open_filesystem (const char *, TSK_IMG_INFO **, TSK_FS_INFO **); > static TSK_WALK_RET_ENUM fswalk_callback (TSK_FS_FILE *, const char *, void *); > +static TSK_WALK_RET_ENUM ifind_callback (TSK_FS_FILE *, const char *, void *); > static char file_type (TSK_FS_FILE *); > static int file_flags (TSK_FS_FILE *fsfile); > static void file_metadata (TSK_FS_META *, guestfs_int_tsk...

v2: - use boolean field in struct - move refactoring to previous series Matteo Cafasso (3): New API: internal_find_block New API: find_block find_block: added API tests daemon/tsk.c | 90 ++++++++++++++++++++++++++++++++++++++++++++ generator/actions.ml | 25 ++++++++++++ src/MAX_PROC_NR | 2 +- src/tsk.c | 17 +++++++++

v3: - fixed attribute walk callback: checking against TSK_FS_BLOCK_FLAG_RAW flag would exclude compressed data blocks which are still important. Yet we want to exclude sparse blocks (TSK_FS_BLOCK_FLAG_SPARSE) as they are not stored on the disk. Matteo Cafasso (3): New API: internal_find_block New API: find_block find_block: added API tests daemon/tsk.c | 91

...+ if (ret == 0) > + ret = send_file_end (0); /* File transfer end. */ > + else > + send_file_end (1); /* Cancel file transfer. */ > + > + fs->close (fs); > + img->close (img); > + > + return ret; > +} > + > + (One extra empty line.) > +static TSK_WALK_RET_ENUM > +findblk_callback (TSK_FS_FILE *fsfile, const char *path, void *data) > +{ > + findblk_data blkdata; > + const TSK_FS_ATTR *fsattr = NULL; > + int ret = 0, count = 0, index = 0; > + uint64_t *block = (uint64_t *) data; Just dereference the pointer directly, so it will not b...

...| 2 +- 3 files changed, 62 insertions(+), 1 deletion(-) diff --git a/daemon/tsk.c b/daemon/tsk.c index 354dfb0..00576e7 100644 --- a/daemon/tsk.c +++ b/daemon/tsk.c @@ -44,6 +44,7 @@ enum tsk_dirent_flags { static int open_filesystem (const char *, TSK_IMG_INFO **, TSK_FS_INFO **); static TSK_WALK_RET_ENUM fswalk_callback (TSK_FS_FILE *, const char *, void *); +static TSK_WALK_RET_ENUM findino_callback (TSK_FS_FILE *, const char *, void *); static int send_dirent_info (TSK_FS_FILE *, const char *); static char file_type (TSK_FS_FILE *); static int file_flags (TSK_FS_FILE *fsfile); @@ -79,6 +80,35...

...| 2 +- 3 files changed, 62 insertions(+), 1 deletion(-) diff --git a/daemon/tsk.c b/daemon/tsk.c index eb4f301..03a7e00 100644 --- a/daemon/tsk.c +++ b/daemon/tsk.c @@ -44,6 +44,7 @@ enum tsk_dirent_flags { static int open_filesystem (const char *, TSK_IMG_INFO **, TSK_FS_INFO **); static TSK_WALK_RET_ENUM fswalk_callback (TSK_FS_FILE *, const char *, void *); +static TSK_WALK_RET_ENUM findino_callback (TSK_FS_FILE *, const char *, void *); static int send_dirent_info (TSK_FS_FILE *, const char *); static char file_type (TSK_FS_FILE *); static int file_flags (TSK_FS_FILE *fsfile); @@ -79,6 +80,35...

...| 2 +- 3 files changed, 85 insertions(+), 1 deletion(-) diff --git a/daemon/tsk.c b/daemon/tsk.c index dd368d7..beb92a3 100644 --- a/daemon/tsk.c +++ b/daemon/tsk.c @@ -44,6 +44,7 @@ enum tsk_dirent_flags { static int open_filesystem (const char *, TSK_IMG_INFO **, TSK_FS_INFO **); static TSK_WALK_RET_ENUM fswalk_callback (TSK_FS_FILE *, const char *, void *); +static TSK_WALK_RET_ENUM ifind_callback (TSK_FS_FILE *, const char *, void *); static char file_type (TSK_FS_FILE *); static int file_flags (TSK_FS_FILE *fsfile); static void file_metadata (TSK_FS_META *, guestfs_int_tsk_dirent *); @@ -78,6...

The find_inode API allows the User to search all the entries referring to a given inode and returns a tsk_dirent structure for each of them. As I didn't want to change unrelated code, there is a little bit of code duplication at the moment. Plan is to refactor the logic in a dedicated set of patches. Matteo Cafasso (3): New API: internal_find_inode New API: find_inode find_inode: added

On Monday 04 April 2016 14:58:35 NoxDaFox wrote: > > > + > > > +static int open_filesystem (const char *device, > > > + TSK_IMG_INFO **img, TSK_FS_INFO **fs); > > > +static TSK_WALK_RET_ENUM fswalk_callback (TSK_FS_FILE *fsfile, > > > + const char *path, void *data); > > > > Single line for forward declarations. > > > > Even if they are longer than 80 chars? Yep. > > > +static char file_type (TSK_FS_F...

Patch ready for merging. v4: - check return code of tsk_fs_attr_walk - pass TSK_FS_FILE_WALK_FLAG_NOSPARSE as additional flag to tsk_fs_attr_walk After discussing with TSK authors the behaviour is clear. [1] In case of COMPRESSED blocks, the callback will be called for all the attributes no matter whether they are on disk or not (sparse). In such cases, the block address will be 0. [2] So

This series is ready for review but requires the previous one to be merged first: https://www.redhat.com/archives/libguestfs/2016-September/msg00101.html The find_block API allows the User to search all the filesystem entries referring to a given data block and returns a tsk_dirent structure for each of them. Use case examples: - Check whether a block containing a deleted file has been re-used

v3: - coding style fixes - comment entry_is_dot logic Matteo Cafasso (6): filesystem_walk: fixed root inode listing daemon: refactor tsk code lib: rename tsk internal function New API: internal_find_inode New API: find_inode find_inode: added API tests daemon/tsk.c | 157 ++++++++++++++++++++++++++++++------------- generator/actions.ml | 21 ++++++

v5: - small doc fix: filesystem_walk claimed '.' and '..' entries were not reported but Root is now reported as '.' - bump to 1.35.6 Matteo Cafasso (6): filesystem_walk: fixed root inode listing daemon: refactor tsk code lib: rename tsk internal function New API: internal_find_inode New API: find_inode find_inode: added API tests daemon/tsk.c

The filesystem_walk0 API parses the FS internals of a partition and returns a list of all the files and directories contained within. It list deleted files and directories as well. For each node, it reports its relative path, its inode and its allocation status. The output is serialised in XDR format and written to the given file. The command is similar to The Sleuth Kit "fls -rp

v4: - refactor entry_is_dot My apologies for the duplicated submission but I did not read the next e-mail. The tsk_fs_dir_walk API will list all the entries including '.' and '..' in a similar manner as for 'ls -a'. This means our callback will be called for the following entries: . <-- the Root entry etc/. etc/.. <-- again the Root entry etc/systemd/.

This series should be ready for merge v6: - rebase on master - changes according to last comments Matteo Cafasso (6): filesystem_walk: fixed root inode listing daemon: refactor tsk code lib: rename tsk internal function New API: internal_find_inode New API: find_inode find_inode: added API tests daemon/tsk.c | 155 ++++++++++++++++++++++++++++++-------------

..._walk (fsattr, flags, attrwalk_callback, (void *) &blkdata); The return code of tsk_fs_attr_walk must be checked. > +/* Attribute walk, searches the given block within the FS node attributes. > + * > + * Return TSK_WALK_CONT on success, TSK_WALK_ERROR on error. > + */ > +static TSK_WALK_RET_ENUM > +attrwalk_callback (TSK_FS_FILE *fsfile, TSK_OFF_T offset, > + TSK_DADDR_T blkaddr, char *buf, size_t size, > + TSK_FS_BLOCK_FLAG_ENUM flags, void *data) > +{ > + findblk_data *blkdata = (findblk_data *) data; > + > + if (!(flags & TS...