similar to: [PATCH v2] added find_inode API

Signed-off-by: Matteo Cafasso <noxdafox@gmail.com> --- daemon/Makefile.am | 3 +- daemon/tsk.c | 186 +++++++++++++++++++++++++++++++++++++++++++++++++++ generator/actions.ml | 16 +++++ m4/guestfs_daemon.m4 | 8 +++ src/MAX_PROC_NR | 2 +- 5 files changed, 213 insertions(+), 2 deletions(-) diff --git a/daemon/Makefile.am b/daemon/Makefile.am index 4e2051b..036def9

The ffind API allows to retrieve a file name from a device given its inode. The function returns a struct "tsknode" which contains the file name, its inode and it's allocation status. The struct will be employed by other APIs as well (fls, ifind etc..). $ ./run guestfish --ro -a /home/noxdafox/disks/ubuntu.qcow2 ><fs> run ><fs> ffind /dev/sda1 2 tsk_name: /

The filesystem_walk0 API parses the FS internals of a partition and returns a list of all the files and directories contained within. It list deleted files and directories as well. For each node, it reports its relative path, its inode and its allocation status. The output is serialised in XDR format and written to the given file. The command is similar to The Sleuth Kit "fls -rp

On Tuesday 05 April 2016 18:47:28 Matteo Cafasso wrote: > The tsk_dirent struct contains the information gathered via TSK APIs. > > The struct contains the following fields: > * tsk_inode: inode of a file > * tsk_type: type of file such as for dirwalk command > * tsk_size: file size in bytes > * tsk_name: path relative to its disk partition > * tsk_allocated: whether

Signed-off-by: Matteo Cafasso <noxdafox@gmail.com> --- generator/actions.ml | 13 ++++ src/Makefile.am | 1 + src/tsk.c | 194 +++++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 208 insertions(+) create mode 100644 src/tsk.c diff --git a/generator/actions.ml b/generator/actions.ml index e33655a..f795721 100644 --- a/generator/actions.ml +++

The tsk_dirent struct contains the information gathered via TSK APIs. The struct contains the following fields: * tsk_inode: inode of a file * tsk_type: type of file such as for dirwalk command * tsk_size: file size in bytes * tsk_name: path relative to its disk partition * tsk_allocated: whether the file has been deleted Signed-off-by: Matteo Cafasso <noxdafox@gmail.com> ---

The tests check that the filesystem_walk command is able to retrieve information regarding both existing and deleted files. A NTFS image is used as Ext3+ filesystems deletion is more aggressive in terms of metadata removal. Signed-off-by: Matteo Cafasso <noxdafox@gmail.com> --- tests/tsk/Makefile.am | 3 +- tests/tsk/test-filesystem-walk.sh | 62

The find_inode API allows the User to search all the entries referring to a given inode and returns a tsk_dirent structure for each of them. As I didn't want to change unrelated code, there is a little bit of code duplication at the moment. Plan is to refactor the logic in a dedicated set of patches. Matteo Cafasso (3): New API: internal_find_inode New API: find_inode find_inode: added

The internal_filesystem_walk command walks through the FS structure of a disk partition and returns all the files or directories which could be found. The command is able to retrieve information regarding deleted or unaccessible files as well where other commands such as stat or find would fail. The gathered list of tsk_dirent structs is serialised into XDR format and written to a file by the

v7: - Merge src/tsk.c refactoring patch with #4 of find_block series Matteo Cafasso (4): lib: logic refactoring New API: internal_find_inode New API: find_inode find_inode: added API tests daemon/tsk.c | 52 ++++++++++++++++++++++++++++++++++ generator/actions.ml | 21 ++++++++++++++ src/MAX_PROC_NR | 2 +- src/tsk.c | 52

v3: - coding style fixes - comment entry_is_dot logic Matteo Cafasso (6): filesystem_walk: fixed root inode listing daemon: refactor tsk code lib: rename tsk internal function New API: internal_find_inode New API: find_inode find_inode: added API tests daemon/tsk.c | 157 ++++++++++++++++++++++++++++++------------- generator/actions.ml | 21 ++++++

v4: - refactor entry_is_dot My apologies for the duplicated submission but I did not read the next e-mail. The tsk_fs_dir_walk API will list all the entries including '.' and '..' in a similar manner as for 'ls -a'. This means our callback will be called for the following entries: . <-- the Root entry etc/. etc/.. <-- again the Root entry etc/systemd/.

This series should be ready for merge v6: - rebase on master - changes according to last comments Matteo Cafasso (6): filesystem_walk: fixed root inode listing daemon: refactor tsk code lib: rename tsk internal function New API: internal_find_inode New API: find_inode find_inode: added API tests daemon/tsk.c | 155 ++++++++++++++++++++++++++++++-------------

2016-04-04 12:48 GMT+03:00 Pino Toscano <ptoscano@redhat.com>: > On Sunday 03 April 2016 16:30:48 Matteo Cafasso wrote: > > The internal_filesystem_walk command walks > > through the FS structure of a disk partition > > and returns all the files or directories > > which could be found. > > > > The command is able to retrieve information > >

v2: - refactor logic to reduce code duplication - better functions naming Matteo Cafasso (6): filesystem_walk: fixed root inode listing daemon: refactor tsk code lib: rename tsk internal function New API: internal_find_inode New API: find_inode find_inode: added API tests daemon/tsk.c | 156 ++++++++++++++++++++++++++++++------------- generator/actions.ml

v5: - small doc fix: filesystem_walk claimed '.' and '..' entries were not reported but Root is now reported as '.' - bump to 1.35.6 Matteo Cafasso (6): filesystem_walk: fixed root inode listing daemon: refactor tsk code lib: rename tsk internal function New API: internal_find_inode New API: find_inode find_inode: added API tests daemon/tsk.c

On Wednesday, 24 August 2016 23:59:53 CEST Matteo Cafasso wrote: > The find_inode API allows the User to search all the entries referring > to a given inode and returns a tsk_dirent structure for each of them. > > As I didn't want to change unrelated code, there is a little bit > of code duplication at the moment. Plan is to refactor the logic > in a dedicated set of

On Thursday, 25 August 2016 16:05:47 CEST NoxDaFox wrote: > 2016-08-25 14:09 GMT+03:00 Pino Toscano <ptoscano@redhat.com>: > > > On Wednesday, 24 August 2016 23:59:53 CEST Matteo Cafasso wrote: > > > The find_inode API allows the User to search all the entries referring > > > to a given inode and returns a tsk_dirent structure for each of them. > > >

On Sunday 03 April 2016 16:30:48 Matteo Cafasso wrote: > The internal_filesystem_walk command walks > through the FS structure of a disk partition > and returns all the files or directories > which could be found. > > The command is able to retrieve information > regarding deleted or unaccessible files as well > where other commands such as stat or find > would fail.

2016-08-25 14:09 GMT+03:00 Pino Toscano <ptoscano@redhat.com>: > On Wednesday, 24 August 2016 23:59:53 CEST Matteo Cafasso wrote: > > The find_inode API allows the User to search all the entries referring > > to a given inode and returns a tsk_dirent structure for each of them. > > > > As I didn't want to change unrelated code, there is a little bit > >