similar to: [PATCH] filesystem_walk: more information into tsk_dirent

Access, modification, last status change and creation time in Unix format as for statns. Number of links pointing to a given entry. If the entry is a symbolic link, report the its target path. A new flag (DIRENT_COMPRESSED 0x04) indicating whether the file is compressed using native filesystem compression support. Signed-off-by: Matteo Cafasso <noxdafox@gmail.com> --- daemon/tsk.c

Access, modification, last status change and creation time in Unix format as for statns. Number of links pointing to a given entry. If the entry is a symbolic link, report its target path. A new flag (DIRENT_COMPRESSED 0x04) indicating whether the file is compressed using native filesystem compression support. Signed-off-by: Matteo Cafasso <noxdafox@gmail.com> --- daemon/tsk.c |

On Monday 04 July 2016 00:00:59 Matteo Cafasso wrote: > Access, modification, last status change and creation time in > Unix format as for statns. > > Number of links pointing to a given entry. > > If the entry is a symbolic link, report its target path. > > A new flag (DIRENT_COMPRESSED 0x04) indicating whether the file is > compressed using native filesystem

Signed-off-by: Matteo Cafasso <noxdafox@gmail.com> --- tests/tsk/test-filesystem-walk.sh | 44 +++++++++++++++++++-------------------- 1 file changed, 22 insertions(+), 22 deletions(-) diff --git a/tests/tsk/test-filesystem-walk.sh b/tests/tsk/test-filesystem-walk.sh index 6ee3f71..d0f0df6 100755 --- a/tests/tsk/test-filesystem-walk.sh +++ b/tests/tsk/test-filesystem-walk.sh @@ -51,17

On Tue, Jun 28, 2016 at 10:49:16PM +0300, Matteo Cafasso wrote: > Already implemented entries. > > tsk_inode > tsk_type > tsk_size > tsk_name > tsk_flags > > Easy ones to add. > > tsk_atime_sec > tsk_atime_nsec > tsk_mtime_sec > tsk_mtime_nsec > tsk_ctime_sec > tsk_ctime_nsec > tsk_blksize > tsk_blocks > > Further ideas. > >

On 28/06/16 23:01, Richard W.M. Jones wrote: > On Tue, Jun 28, 2016 at 10:49:16PM +0300, Matteo Cafasso wrote: >> Already implemented entries. >> >> tsk_inode >> tsk_type >> tsk_size >> tsk_name >> tsk_flags >> >> Easy ones to add. >> >> tsk_atime_sec >> tsk_atime_nsec >> tsk_mtime_sec >> tsk_mtime_nsec >>

Already implemented entries. tsk_inode tsk_type tsk_size tsk_name tsk_flags Easy ones to add. tsk_atime_sec tsk_atime_nsec tsk_mtime_sec tsk_mtime_nsec tsk_ctime_sec tsk_ctime_nsec tsk_blksize tsk_blocks Further ideas. tsk_nlink tsk_link_name Signed-off-by: Matteo Cafasso <noxdafox@gmail.com> --- daemon/tsk.c | 4 +++- generator/structs.ml | 6

Refactor logic in preparation for new APIs. Signed-off-by: Matteo Cafasso <noxdafox@gmail.com> --- daemon/tsk.c | 89 ++++++++++++++++++++++++++++++------------------------------ 1 file changed, 44 insertions(+), 45 deletions(-) diff --git a/daemon/tsk.c b/daemon/tsk.c index 6e6df6d..eb4f301 100644 --- a/daemon/tsk.c +++ b/daemon/tsk.c @@ -44,12 +44,12 @@ enum tsk_dirent_flags { static

v4: - refactor entry_is_dot My apologies for the duplicated submission but I did not read the next e-mail. The tsk_fs_dir_walk API will list all the entries including '.' and '..' in a similar manner as for 'ls -a'. This means our callback will be called for the following entries: . <-- the Root entry etc/. etc/.. <-- again the Root entry etc/systemd/.

- generator: Added tsk_dirent struct The tsk_dirent struct contains the information gathered via TSK APIs. The struct contains the following fields: * tsk_inode: inode of a file * tsk_type: type of file such as for dirwalk command * tsk_size: file size in bytes * tsk_name: path relative to its disk partition * tsk_flags: bitfield containing extra information - configure: Added libtsk

On Friday, 26 August 2016 15:15:17 CEST noxdafox wrote: > On 26/08/16 14:15, Pino Toscano wrote: > > On Thursday, 25 August 2016 23:53:51 CEST Matteo Cafasso wrote: > >> With the current implementation, the root inode of the given partition > >> is ignored. > >> > >> The root inode is now reported. Its name will be a single dot '.' > >>

On 26/08/16 14:15, Pino Toscano wrote: > On Thursday, 25 August 2016 23:53:51 CEST Matteo Cafasso wrote: >> With the current implementation, the root inode of the given partition >> is ignored. >> >> The root inode is now reported. Its name will be a single dot '.' >> reproducing the TSK API. >> >> Signed-off-by: Matteo Cafasso

The internal_find_inode command searches all entries referring to the given inode and returns a tsk_dirent structure for each of them. The command is able to retrieve information regarding deleted or unaccessible files where other commands such as stat or find would fail. The gathered list of tsk_dirent structs is serialised into XDR format and written to a file by the appliance. Signed-off-by:

On Thursday, 25 August 2016 23:53:51 CEST Matteo Cafasso wrote: > With the current implementation, the root inode of the given partition > is ignored. > > The root inode is now reported. Its name will be a single dot '.' > reproducing the TSK API. > > Signed-off-by: Matteo Cafasso <noxdafox@gmail.com> > --- > daemon/tsk.c | 17 ++++++++++++++--- > 1

The internal_filesystem_walk command walks through the FS structure of a disk partition and returns all the files or directories which could be found. The command is able to retrieve information regarding deleted or unaccessible files as well where other commands such as stat or find would fail. The gathered list of tsk_dirent structs is serialised into XDR format and written to a file by the

Report access, modification, status update and creation time in Unix format. Report number of links pointing to a given entry. If the entry is a symbolic link, report the path of its target. If the filesystem supports native/transparent compression, report compressed files with dedicated flag (DIRENT_COMPRESSED 0x04). Matteo Cafasso (2): filesystem_walk: more information into tsk_dirent

The internal_filesystem_walk command walks through the FS structures of a disk partition and returns all the files or directories which could be found. The command is able to retrieve information regarding deleted or unaccessible files where other commands such as stat or find would fail. The gathered list of tsk_dirent structs is serialised into XDR format and written to a file by the

2016-04-04 12:48 GMT+03:00 Pino Toscano <ptoscano@redhat.com>: > On Sunday 03 April 2016 16:30:48 Matteo Cafasso wrote: > > The internal_filesystem_walk command walks > > through the FS structure of a disk partition > > and returns all the files or directories > > which could be found. > > > > The command is able to retrieve information > >

With the current implementation, the root inode of the given partition is ignored. The root inode is now reported. Its name will be a single dot '.' reproducing the TSK API. Signed-off-by: Matteo Cafasso <noxdafox@gmail.com> --- daemon/tsk.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/daemon/tsk.c b/daemon/tsk.c index dd368d7..4a0517b 100644 ---

With the current implementation, the root inode of the given partition is ignored. The root inode is now reported. Its name will be a single dot '.' reproducing the TSK API. Signed-off-by: Matteo Cafasso <noxdafox@gmail.com> --- daemon/tsk.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/daemon/tsk.c b/daemon/tsk.c index dd368d7..6e6df6d