similar to: [PATCH] ffind API to retrieve a file name given its inode

Renamed ffind API to find_inode. Renamed tsknode struct to tsk_node. Changed struct field from int64 to uint64. As pointed out on IRC it would be better to agree on some naming convention. One option would be to prefix all the forensics APIs with tsk_ as TSK (The Sleuth Kit) is the main tool used for implementing them. Other option could be giving generic names allowing us to change underlying

The filesystem_walk0 API parses the FS internals of a partition and returns a list of all the files and directories contained within. It list deleted files and directories as well. For each node, it reports its relative path, its inode and its allocation status. The output is serialised in XDR format and written to the given file. The command is similar to The Sleuth Kit "fls -rp

On Tuesday 05 April 2016 18:47:28 Matteo Cafasso wrote: > The tsk_dirent struct contains the information gathered via TSK APIs. > > The struct contains the following fields: > * tsk_inode: inode of a file > * tsk_type: type of file such as for dirwalk command > * tsk_size: file size in bytes > * tsk_name: path relative to its disk partition > * tsk_allocated: whether

v3: - File size will be reported as - 1 if it cannot be retrieved. - Code improvements based on comments. Matteo Cafasso (5): generator: Added tsk_dirent struct configure: Added libtsk compile-time check daemon: Added internal_filesystem_walk command appliance: Added filesystem_walk command appliance: Added filesystem_walk command tests daemon/Makefile.am | 4 +-

v2: - Increased the amount of collected information from the FS content. - Moved filesystem_walk0 as internal command. - Code improvement based on comments. - Adhere to project's coding style. - Better command documentation. - More robust tests. Patch ready for review, code available at: https://github.com/noxdafox/libguestfs/tree/filesystem_walk Matteo Cafasso (5): generator:

The filesystem_walk API parses the FS internals of a partition and returns a list of all the files and directories contained within. It list deleted files and directories as well. For each node, it reports its relative path, its inode and its allocation status. This is the end user API for inspecting a disk partition content. The command can handle filenames with special characters. Example

On Monday 04 April 2016 14:58:35 NoxDaFox wrote: > > > + > > > +static int open_filesystem (const char *device, > > > + TSK_IMG_INFO **img, TSK_FS_INFO **fs); > > > +static TSK_WALK_RET_ENUM fswalk_callback (TSK_FS_FILE *fsfile, > > > + const char *path, void *data); > > > >

On Sunday 03 April 2016 16:30:48 Matteo Cafasso wrote: > The internal_filesystem_walk command walks > through the FS structure of a disk partition > and returns all the files or directories > which could be found. > > The command is able to retrieve information > regarding deleted or unaccessible files as well > where other commands such as stat or find > would fail.

v4: - Changed tsk_allocated struct field into tsk_flags. - Added optional dependency in documentation. - Use asprintf and perror instead of asprintf_nowarn and fprintf. - Ensure CLEANUP_FREE vars are initialised. - Reworked the function documentation. - Improved tests robustness. Matteo Cafasso (5): generator: Added tsk_dirent struct configure: Added libtsk compile-time check

v8: - rebase on master - bump version to 1.33.37 - squash commits 1, 2, 3 Kept original commits messages when squashing them. Matteo Cafasso (3): New API: internal_filesystem_walk New API: filesystem_walk lib: Added filesystem_walk command tests daemon/Makefile.am | 4 +- daemon/tsk.c | 249 ++++++++++++++++++++++++++++++++++++++

Signed-off-by: Matteo Cafasso <noxdafox@gmail.com> --- daemon/Makefile.am | 3 +- daemon/tsk.c | 186 +++++++++++++++++++++++++++++++++++++++++++++++++++ generator/actions.ml | 16 +++++ m4/guestfs_daemon.m4 | 8 +++ src/MAX_PROC_NR | 2 +- 5 files changed, 213 insertions(+), 2 deletions(-) diff --git a/daemon/Makefile.am b/daemon/Makefile.am index 4e2051b..036def9

On Tuesday 05 April 2016 18:47:32 Matteo Cafasso wrote: > The tests check that the filesystem_walk command is able to retrieve > information regarding both existing and deleted files. > > A NTFS image is used as Ext3+ filesystems deletion is more aggressive > in terms of metadata removal. > > Signed-off-by: Matteo Cafasso <noxdafox@gmail.com> > --- >

v5: - fixed compile-time warning - removed unused flag enumeration - new version 1.33.19 Patch ready for review. Matteo Cafasso (5): generator: Added tsk_dirent struct configure: Added libtsk compile-time check New API: internal_filesystem_walk New API: filesystem_walk lib: Added filesystem_walk command tests daemon/Makefile.am | 4 +- daemon/tsk.c

On Mon, Jun 13, 2016 at 07:50:52PM +0300, Matteo Cafasso wrote: > diff --git a/generator/structs.ml b/generator/structs.ml > index 6017ba6..3c2cc61 100644 > --- a/generator/structs.ml > +++ b/generator/structs.ml > @@ -444,6 +444,19 @@ let structs = [ > ]; > s_camel_name = "InternalMountable"; > }; > + > + (* The Sleuth Kit directory entry

v6: - added metadata reallocation flag in tsk_flags Certain filesystems separate file name structures and metadata ones. Therefore, deleted entries with file name structures in an unallocated state might point to metadata structures which have been reallocated to new files. A flag set to 1 is generally an indication that the information gathered from the metadata structure (file

v7: - iterate over output file instead of reading it into memory Instead of reading the whole output file in memory and iterating over the resulting buffer, use XDR primitives to directly iterate over the file itself. This should reduce the API memory consumption. Patch ready for review. Code available at: https://github.com/noxdafox/libguestfs/tree/filesystem_walk Matteo Cafasso

v9: - add missing files: java/Makefile.inc, java/com/redhat/et/libguestfs/.gitignore, gobject/Makefile.inc - reserve space in tsk_dirent struct for future usage - use int instead of bool_t type - improve API documentation Matteo Cafasso (3): New API: internal_filesystem_walk New API: filesystem_walk lib: Added filesystem_walk command tests daemon/Makefile.am

Already implemented entries. tsk_inode tsk_type tsk_size tsk_name tsk_flags Easy ones to add. tsk_atime_sec tsk_atime_nsec tsk_mtime_sec tsk_mtime_nsec tsk_ctime_sec tsk_ctime_nsec tsk_blksize tsk_blocks Further ideas. tsk_nlink tsk_link_name Signed-off-by: Matteo Cafasso <noxdafox@gmail.com> --- daemon/tsk.c | 4 +++- generator/structs.ml | 6

Report access, modification, status update and creation time in Unix format. Report number of links pointing to a given entry. If the entry is a symbolic link, report the path of its target. If the filesystem supports native/transparent compression, report compressed files with dedicated flag (DIRENT_COMPRESSED 0x04). Matteo Cafasso (2): filesystem_walk: more information into tsk_dirent

On Monday 04 July 2016 00:00:59 Matteo Cafasso wrote: > Access, modification, last status change and creation time in > Unix format as for statns. > > Number of links pointing to a given entry. > > If the entry is a symbolic link, report its target path. > > A new flag (DIRENT_COMPRESSED 0x04) indicating whether the file is > compressed using native filesystem