similar to: [PATCH] added ntfscat_i api

On 22/02/16 17:26, Richard W.M. Jones wrote: > On Sun, Feb 21, 2016 at 11:22:23PM +0200, Matteo Cafasso wrote: >> Adding ntfscat_i command for downloading files based on their inode number. >> >> This allows the dowload of files unaccessible otherwise from a NTFS guest disk image. > The patch seems fine, but it really needs a test otherwise this > feature could silently

Adding ntfscat_i command for downloading files based on their inode number. This allows the dowload of files unaccessible otherwise from a NTFS guest disk image. Signed-off-by: Matteo Cafasso <noxdafox@gmail.com> --- daemon/ntfs.c | 62 ++++++++++++++++++++++++++++++++++++++++++++++++++++ generator/actions.ml | 15 +++++++++++++ 2 files changed, 77 insertions(+) diff --git

On Sun, Feb 21, 2016 at 11:22:23PM +0200, Matteo Cafasso wrote: > Adding ntfscat_i command for downloading files based on their inode number. > > This allows the dowload of files unaccessible otherwise from a NTFS guest disk image. The patch seems fine, but it really needs a test otherwise this feature could silently break. Have a look at the tests/ntfsclone/ subdirectory for the

On Mon, Feb 22, 2016 at 07:23:45PM +0200, noxdafox wrote: > On 22/02/16 17:26, Richard W.M. Jones wrote: > >On Sun, Feb 21, 2016 at 11:22:23PM +0200, Matteo Cafasso wrote: > >>Adding ntfscat_i command for downloading files based on their inode number. > >> > >>This allows the dowload of files unaccessible otherwise from a NTFS guest disk image. > >The

On 22/02/16 19:43, Richard W.M. Jones wrote: > On Mon, Feb 22, 2016 at 07:23:45PM +0200, noxdafox wrote: >> On 22/02/16 17:26, Richard W.M. Jones wrote: >>> On Sun, Feb 21, 2016 at 11:22:23PM +0200, Matteo Cafasso wrote: >>>> Adding ntfscat_i command for downloading files based on their inode number. >>>> >>>> This allows the dowload of files

Test is based on file signature, it checks whether the extracted file is the $MFT. Signed-off-by: Matteo Cafasso <noxdafox@gmail.com> --- Makefile.am | 1 + configure.ac | 1 + generator/actions.ml | 6 ++++- tests/ntfscat/Makefile.am | 26 +++++++++++++++++++++ tests/ntfscat/test-ntfscat.sh | 53 +++++++++++++++++++++++++++++++++++++++++++

"icat" name comes from the employed command line tool which might be replaced later on with a different implementation. The command name is a bit confusing because it's similar to "cat" but act as "donwload". Therefore I am renaming it with a more clear name. At the same time I cleaned up a bit the code and improved it's readability and code comments. This

The command name is a bit confusing because it's similar to "cat" but act as "donwload". Therefore I am renaming it with a more clear name. At the same go I cleaned up a bit the code following the standards and improved the API documentation. This patch is ready for review. Code available at: https://github.com/noxdafox/libguestfs/tree/download_inode Matteo Cafasso (3):

The Sleuth Kit is a filesystem forensic tool for accessing disk volumes and extracting digital evidence from. http://www.sleuthkit.org/ The icat API allows to download a file from a device given its metadata number (inode). It supports multiple filesystem types. The icat command allows to access to otherwise unreachable files such as filesystem data structures and deleted files which content is

As discussed in the topic: https://www.redhat.com/archives/libguestfs/2016-March/msg00018.html I'd like to add to libguestfs the disk forensics capabilities offered by The Sleuth Kit. http://www.sleuthkit.org/ The two APIs I'm adding with the patch are a simple example of which type of features TSK can enable. The icat API it's very similar to the previously added ntfscat_i but it

This miscellaneous patch adds bindings for: - ntfsfix - ntfsclone - ntfslabel and unifies filesystem label setting through a single API 'set-label' which replaces 'set-e2label' and is also able to set labels on NTFS using the ntfslabel program. 'ntfsfix' has been added as a possible way to fix RHBZ#797760. However I have not found a way to fully fix this bug. See

Use PRIi64 as format string for int64_t, so it builds and works fine also on 32bit. Also switch from asprintf_nowarn to asprintf, since no custom formats (eg %Q, %R) are used. --- daemon/ntfs.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/daemon/ntfs.c b/daemon/ntfs.c index 92088f7..e555c63 100644 --- a/daemon/ntfs.c +++ b/daemon/ntfs.c @@ -282,8 +282,8 @@

On Wednesday, 24 August 2016 23:59:54 CEST Matteo Cafasso wrote: > The internal_find_inode command searches all entries referring to the > given inode and returns a tsk_dirent structure for each of them. > > The command is able to retrieve information regarding deleted > or unaccessible files where other commands such as stat or find > would fail. > > The gathered list of

The find_inode API allows the User to search all the entries referring to a given inode and returns a tsk_dirent structure for each of them. As I didn't want to change unrelated code, there is a little bit of code duplication at the moment. Plan is to refactor the logic in a dedicated set of patches. Matteo Cafasso (3): New API: internal_find_inode New API: find_inode find_inode: added

On Tue, Feb 02, 2016 at 07:40:12PM +0200, noxdafox wrote: > Greetings, > > I'm playing around an idea and I'd like to ask you some questions. > > I'd like to extract the MFT table from a disk image file. The idea > is to employ it to build a sort of reverse lookup table which, given > a cluster, could retrieve the corresponding file with the related >

On Sunday 03 April 2016 16:30:48 Matteo Cafasso wrote: > The internal_filesystem_walk command walks > through the FS structure of a disk partition > and returns all the files or directories > which could be found. > > The command is able to retrieve information > regarding deleted or unaccessible files as well > where other commands such as stat or find > would fail.

v2: - Increased the amount of collected information from the FS content. - Moved filesystem_walk0 as internal command. - Code improvement based on comments. - Adhere to project's coding style. - Better command documentation. - More robust tests. Patch ready for review, code available at: https://github.com/noxdafox/libguestfs/tree/filesystem_walk Matteo Cafasso (5): generator:

On Tue, Feb 04, 2014 at 04:01:32PM +0100, Pino Toscano wrote: > +static char * > +extract_optionally_quoted (const char *value) > +{ > + size_t value_len = strlen (value); > + > + if (value_len >= 2 && > + ((value[0] == '\'' && value[value_len - 1] == '\'') || > + (value[0] == '"' &&

This series should be ready for merge v6: - rebase on master - changes according to last comments Matteo Cafasso (6): filesystem_walk: fixed root inode listing daemon: refactor tsk code lib: rename tsk internal function New API: internal_find_inode New API: find_inode find_inode: added API tests daemon/tsk.c | 155 ++++++++++++++++++++++++++++++-------------

On Mon, Feb 22, 2016 at 11:58:28PM +0200, noxdafox wrote: > Once fixed that and few other things I got stuck with this: > > SRCDIR=. LAYOUT=partitions ../../run --test ./make-fedora-img.pl > Can't locate loadable object for module Sys::Guestfs in @INC (@INC > contains: /home/noxdafox/development/libguestfs/perl/blib/lib > /home/noxdafox/development/libguestfs/perl/blib/arch