similar to: [PATCH] daemon: tsk: handle new enum values in sleuthkit 4.5

On Tuesday 29 March 2016 22:56:29 Matteo Cafasso wrote: > In order to support the new features I am renaming the file with a better name. > > The file sleuthkit.c will contain the code depending on the sleuthkit package. > > The original tsk.c file will contain the logic built using libtsk > which is the sleuthkit core library. Makes sense, pushed to git with two small

In order to support the new features I am renaming the file with a better name. The file sleuthkit.c will contain the code depending on the sleuthkit package. The original tsk.c file will contain the logic built using libtsk which is the sleuthkit core library. This patch is ready for review. Code available at: https://github.com/noxdafox/libguestfs/tree/sleuthkit_rename Signed-off-by: Matteo

The internal_filesystem_walk command walks through the FS structures of a disk partition and returns all the files or directories which could be found. The command is able to retrieve information regarding deleted or unaccessible files where other commands such as stat or find would fail. The gathered list of tsk_dirent structs is serialised into XDR format and written to a file by the

>From 'available icat' to 'available sleuthkit'. Signed-off-by: Matteo Cafasso <noxdafox@gmail.com> --- daemon/tsk.c | 6 +++--- generator/actions.ml | 2 +- tests/tsk/test-icat.sh | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/daemon/tsk.c b/daemon/tsk.c index 647d1e7..0fe1250 100644 --- a/daemon/tsk.c +++ b/daemon/tsk.c @@ -31,12

Small cosmetic changes. Signed-off-by: Matteo Cafasso <noxdafox@gmail.com> --- daemon/sleuthkit.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/daemon/sleuthkit.c b/daemon/sleuthkit.c index ce738e3..e642731 100644 --- a/daemon/sleuthkit.c +++ b/daemon/sleuthkit.c @@ -47,7 +47,8 @@ do_download_inode (const mountable_t *mountable, int64_t inode) } /*

Removed duplicated code. Signed-off-by: Matteo Cafasso <noxdafox@gmail.com> --- src/tsk.c | 69 ++++++++++++++++++++++++++------------------------------------- 1 file changed, 28 insertions(+), 41 deletions(-) diff --git a/src/tsk.c b/src/tsk.c index 6b1b29c..8e6d266 100644 --- a/src/tsk.c +++ b/src/tsk.c @@ -34,96 +34,71 @@ #include "guestfs-internal-all.h" #include

Refactor logic in preparation for new APIs. Signed-off-by: Matteo Cafasso <noxdafox@gmail.com> --- daemon/tsk.c | 89 ++++++++++++++++++++++++++++++------------------------------ 1 file changed, 44 insertions(+), 45 deletions(-) diff --git a/daemon/tsk.c b/daemon/tsk.c index 6e6df6d..eb4f301 100644 --- a/daemon/tsk.c +++ b/daemon/tsk.c @@ -44,12 +44,12 @@ enum tsk_dirent_flags { static

- generator: Added tsk_dirent struct The tsk_dirent struct contains the information gathered via TSK APIs. The struct contains the following fields: * tsk_inode: inode of a file * tsk_type: type of file such as for dirwalk command * tsk_size: file size in bytes * tsk_name: path relative to its disk partition * tsk_flags: bitfield containing extra information - configure: Added libtsk

Hello, I have attached a patch that allowed the build to complete successfully on macOS. I haven't tried building the daemon under macOS, but I patched two files there in a similar manner to some of the other files for consistency (just the include order for rpc headers). Thanks, Adam Robinson Virtualization and Cloud Infrastructure Senior Information and Technology Services University of

v3: - File size will be reported as - 1 if it cannot be retrieved. - Code improvements based on comments. Matteo Cafasso (5): generator: Added tsk_dirent struct configure: Added libtsk compile-time check daemon: Added internal_filesystem_walk command appliance: Added filesystem_walk command appliance: Added filesystem_walk command tests daemon/Makefile.am | 4 +-

v5: - fixed compile-time warning - removed unused flag enumeration - new version 1.33.19 Patch ready for review. Matteo Cafasso (5): generator: Added tsk_dirent struct configure: Added libtsk compile-time check New API: internal_filesystem_walk New API: filesystem_walk lib: Added filesystem_walk command tests daemon/Makefile.am | 4 +- daemon/tsk.c

v4: - Changed tsk_allocated struct field into tsk_flags. - Added optional dependency in documentation. - Use asprintf and perror instead of asprintf_nowarn and fprintf. - Ensure CLEANUP_FREE vars are initialised. - Reworked the function documentation. - Improved tests robustness. Matteo Cafasso (5): generator: Added tsk_dirent struct configure: Added libtsk compile-time check

diff --git a/daemon/tsk.c b/daemon/tsk.c index ad10d74fe..00a4b04b4 100644 --- a/daemon/tsk.c +++ b/daemon/tsk.c @@ -23,8 +23,8 @@ #include <inttypes.h> #include <string.h> #include <unistd.h> -#include <rpc/xdr.h> #include <rpc/types.h> +#include <rpc/xdr.h> Is it generally required on Macs that rpc/xdr.h is included after rpc/types.h, or is this change a

v6: - added metadata reallocation flag in tsk_flags Certain filesystems separate file name structures and metadata ones. Therefore, deleted entries with file name structures in an unallocated state might point to metadata structures which have been reallocated to new files. A flag set to 1 is generally an indication that the information gathered from the metadata structure (file

v7: - iterate over output file instead of reading it into memory Instead of reading the whole output file in memory and iterating over the resulting buffer, use XDR primitives to directly iterate over the file itself. This should reduce the API memory consumption. Patch ready for review. Code available at: https://github.com/noxdafox/libguestfs/tree/filesystem_walk Matteo Cafasso

v1 was here: https://www.redhat.com/archives/libguestfs/2018-May/msg00042.html v2: - Split into two patches dealing with the different issues. - git format & attribution. I only tested this on Linux but at least it doesn't break things there. Rich.

v9: - add missing files: java/Makefile.inc, java/com/redhat/et/libguestfs/.gitignore, gobject/Makefile.inc - reserve space in tsk_dirent struct for future usage - use int instead of bool_t type - improve API documentation Matteo Cafasso (3): New API: internal_filesystem_walk New API: filesystem_walk lib: Added filesystem_walk command tests daemon/Makefile.am

v8: - rebase on master - bump version to 1.33.37 - squash commits 1, 2, 3 Kept original commits messages when squashing them. Matteo Cafasso (3): New API: internal_filesystem_walk New API: filesystem_walk lib: Added filesystem_walk command tests daemon/Makefile.am | 4 +- daemon/tsk.c | 249 ++++++++++++++++++++++++++++++++++++++