[Libguestfs] Libguestfs as filesystem forensic tool

[Richard W.M. Jones]

On Wed, Mar 02, 2016 at 11:26:08PM +0200, noxdafox wrote:
> 
> 
> On 02/03/16 18:24, Richard W.M. Jones wrote:
> >On Wed, Mar 02, 2016 at 05:59:32PM +0200, noxdafox wrote:
> >>One of the patches I'm talking about would add TSK (The Sleuth Kit)
> >>as a dependency within the appliance.
> >>
> >>This would bring new APIs such as:
> >>  'fls' more powerful 'ls' command allowing to get list of deleted
> >>files or timelines at a given path.
> >>  'icat' similar to ntfscat-i but it supports multiple FS.
> >>
> >>Yet I'm not sure whether it's desirable as it is for a narrow use
> >>case and on my Debian box TSK is a 12Mb binary.
> >Yes that's a rather large dependency.
> >
> >However it's possible to use optgroups ["optional" field in
> >generator/actions.ml] and subpackaging to mean that end users don't
> >need to install this dependency unless they want it.
> If I understood correctly, I just need to set the optional field in
> the API and then issue the command: "./configure
> --with-extra-packages=... " right?

Actually even easier than that.  Just add the TSK package name to
`appliance/packagelist.in'.

However you should also use the optional field in `generator/actions.ml'
for your new API(s) because it allows callers to query whether the
feature is available (using the guestfs_feature_available API).  When
you use the optional field, you will also need to write a function in
the daemon called optgroup_<name>_available.  See `daemon/ntfs.c' for
an example.

Note the package name and optional field name don't need to be the
same.  Also there is not necessarily a 1-1 mapping: it may make sense
to have several optgroups, or may not.

Rich.

-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
Read my programming and virtualization blog: http://rwmj.wordpress.com
virt-df lists disk usage of guests without needing to install any
software inside the virtual machine.  Supports Linux and Windows.
http://people.redhat.com/~rjones/virt-df/