[Libguestfs] [PATCH v4 0/3] New API - find_block
Matteo Cafasso
noxdafox at gmail.com
Sat Oct 8 15:27:21 UTC 2016
Patch ready for merging.
v4:
- check return code of tsk_fs_attr_walk
- pass TSK_FS_FILE_WALK_FLAG_NOSPARSE as additional flag to tsk_fs_attr_walk
After discussing with TSK authors the behaviour is clear. [1]
In case of COMPRESSED blocks, the callback will be called for all the attributes no matter whether they are on disk or not (sparse). In such cases, the block address will be 0. [2]
So we do not have to enforce the blocks to be RAW as we would be missing COMPRESSED ones (NTFS only).
[1] https://github.com/sleuthkit/sleuthkit/pull/721
[2] http://www.sleuthkit.org/sleuthkit/docs/api-docs/4.2/group__fslib.html#ga3ce8349107b00e1b1502c86a5d6c0727
Matteo Cafasso (3):
New API: internal_find_block
New API: find_block
find_block: added API tests
daemon/tsk.c | 96 ++++++++++++++++++++++++++++++++++++++++++++
generator/actions.ml | 25 ++++++++++++
src/MAX_PROC_NR | 2 +-
src/tsk.c | 17 ++++++++
tests/tsk/Makefile.am | 1 +
tests/tsk/test-find-block.sh | 66 ++++++++++++++++++++++++++++++
6 files changed, 206 insertions(+), 1 deletion(-)
create mode 100755 tests/tsk/test-find-block.sh
--
2.9.3
More information about the Libguestfs
mailing list