Skip to content
GitLab
Explore
Sign in
Primary navigation
Search or go to…
Project
S
Sleuthkit
Manage
Activity
Members
Labels
Plan
Issues
Issue boards
Milestones
Iterations
Requirements
Code
Merge requests
Repository
Branches
Commits
Tags
Repository graph
Compare revisions
Snippets
Locked files
Build
Pipelines
Jobs
Pipeline schedules
Test cases
Artifacts
Deploy
Releases
Package registry
Model registry
Operate
Environments
Terraform modules
Monitor
Incidents
Analyze
Value stream analytics
Contributor analytics
CI/CD analytics
Repository analytics
Code review analytics
Issue analytics
Insights
Model experiments
Help
Help
Support
GitLab documentation
Compare GitLab plans
Community forum
Contribute to GitLab
Provide feedback
Terms and privacy
Keyboard shortcuts
?
Snippets
Groups
Projects
Show more breadcrumbs
IRT
Sleuthkit
Commits
1a432504
Commit
1a432504
authored
8 years ago
by
Brian Carrier
Committed by
GitHub
8 years ago
Browse files
Options
Downloads
Plain Diff
Merge pull request #831 from uckelman-sf/cleanup
Code cleanup
parents
157e82dc
72cdc9d9
No related branches found
No related tags found
No related merge requests found
Changes
5
Hide whitespace changes
Inline
Side-by-side
Showing
5 changed files
tsk/auto/auto.cpp
+6
-5
6 additions, 5 deletions
tsk/auto/auto.cpp
tsk/fs/ffs.c
+1
-1
1 addition, 1 deletion
tsk/fs/ffs.c
tsk/fs/fs_open.c
+43
-130
43 additions, 130 deletions
tsk/fs/fs_open.c
tsk/fs/tsk_fs_i.h
+1
-1
1 addition, 1 deletion
tsk/fs/tsk_fs_i.h
tsk/vs/mm_part.c
+3
-7
3 additions, 7 deletions
tsk/vs/mm_part.c
with
54 additions
and
144 deletions
tsk/auto/auto.cpp
+
6
−
5
View file @
1a432504
...
@@ -255,9 +255,8 @@ TSK_WALK_RET_ENUM
...
@@ -255,9 +255,8 @@ TSK_WALK_RET_ENUM
return
TSK_WALK_STOP
;
return
TSK_WALK_STOP
;
// process it
// process it
TSK_RETVAL_ENUM
retval2
=
TSK_RETVAL_ENUM
retval2
=
tsk
->
findFilesInFsRet
(
tsk
->
findFilesInFsRet
(
a_vs_part
->
start
*
a_vs_part
->
start
*
a_vs_part
->
vs
->
block_size
,
TSK_FS_TYPE_DETECT
);
a_vs_part
->
vs
->
block_size
,
TSK_FS_TYPE_DETECT
);
if
((
retval2
==
TSK_STOP
)
||
(
tsk
->
getStopProcessing
()))
{
if
((
retval2
==
TSK_STOP
)
||
(
tsk
->
getStopProcessing
()))
{
return
TSK_WALK_STOP
;
return
TSK_WALK_STOP
;
}
}
...
@@ -360,8 +359,10 @@ TSK_RETVAL_ENUM
...
@@ -360,8 +359,10 @@ TSK_RETVAL_ENUM
return
TSK_ERR
;
return
TSK_ERR
;
}
}
else
if
(
getCurVsPartFlag
()
&
TSK_VS_PART_FLAG_ALLOC
)
{
else
if
(
getCurVsPartFlag
()
&
TSK_VS_PART_FLAG_ALLOC
)
{
tsk_error_set_errstr2
(
"Sector offset: %"
PRIuOFF
", Partition Type: %s"
,
tsk_error_set_errstr2
(
a_start
/
512
,
getCurVsPartDescr
().
c_str
()
);
"Sector offset: %"
PRIuOFF
", Partition Type: %s"
,
a_start
/
512
,
getCurVsPartDescr
().
c_str
()
);
registerError
();
registerError
();
return
TSK_ERR
;
return
TSK_ERR
;
}
}
...
...
This diff is collapsed.
Click to expand it.
tsk/fs/ffs.c
+
1
−
1
View file @
1a432504
...
@@ -1980,7 +1980,7 @@ ffs_close(TSK_FS_INFO * fs)
...
@@ -1980,7 +1980,7 @@ ffs_close(TSK_FS_INFO * fs)
* @returns NULL on error or if data is not a FFS file system
* @returns NULL on error or if data is not a FFS file system
*/
*/
TSK_FS_INFO
*
TSK_FS_INFO
*
ffs_open
(
TSK_IMG_INFO
*
img_info
,
TSK_OFF_T
offset
,
TSK_FS_TYPE_ENUM
ftype
)
ffs_open
(
TSK_IMG_INFO
*
img_info
,
TSK_OFF_T
offset
,
TSK_FS_TYPE_ENUM
ftype
,
uint8_t
test
)
{
{
char
*
myname
=
"ffs_open"
;
char
*
myname
=
"ffs_open"
;
FFS_INFO
*
ffs
;
FFS_INFO
*
ffs
;
...
...
This diff is collapsed.
Click to expand it.
tsk/fs/fs_open.c
+
43
−
130
View file @
1a432504
...
@@ -94,151 +94,64 @@ tsk_fs_open_img(TSK_IMG_INFO * a_img_info, TSK_OFF_T a_offset,
...
@@ -94,151 +94,64 @@ tsk_fs_open_img(TSK_IMG_INFO * a_img_info, TSK_OFF_T a_offset,
* We need to try all of them in case more than one matches
* We need to try all of them in case more than one matches
*/
*/
if
(
a_ftype
==
TSK_FS_TYPE_DETECT
)
{
if
(
a_ftype
==
TSK_FS_TYPE_DETECT
)
{
TSK_FS_INFO
*
fs_info
,
*
fs_s
e
t
=
NULL
;
TSK_FS_INFO
*
fs_info
,
*
fs_
fir
st
=
NULL
;
c
har
*
set
=
NULL
;
c
onst
char
*
name_first
;
if
(
tsk_verbose
)
if
(
tsk_verbose
)
tsk_fprintf
(
stderr
,
tsk_fprintf
(
stderr
,
"fsopen: Auto detection mode at offset %"
PRIuOFF
"
\n
"
,
"fsopen: Auto detection mode at offset %"
PRIuOFF
"
\n
"
,
a_offset
);
a_offset
);
if
((
fs_info
=
const
struct
{
ntfs_open
(
a_img_info
,
a_offset
,
TSK_FS_TYPE_NTFS_DETECT
,
char
*
name
;
1
))
!=
NULL
)
{
TSK_FS_INFO
*
(
*
open
)(
TSK_IMG_INFO
*
,
TSK_OFF_T
,
set
=
"NTFS"
;
TSK_FS_TYPE_ENUM
,
uint8_t
);
fs_set
=
fs_info
;
TSK_FS_TYPE_ENUM
type
;
}
}
FS_OPENERS
[]
=
{
else
{
{
"NTFS"
,
ntfs_open
,
TSK_FS_TYPE_NTFS_DETECT
},
tsk_error_reset
();
{
"FAT"
,
fatfs_open
,
TSK_FS_TYPE_FAT_DETECT
},
}
{
"EXT2/3/4"
,
ext2fs_open
,
TSK_FS_TYPE_EXT_DETECT
},
{
"UFS"
,
ffs_open
,
TSK_FS_TYPE_FFS_DETECT
},
if
((
fs_info
=
{
"YAFFS2"
,
yaffs2_open
,
TSK_FS_TYPE_YAFFS2_DETECT
},
fatfs_open
(
a_img_info
,
a_offset
,
TSK_FS_TYPE_FAT_DETECT
,
1
))
!=
NULL
)
{
if
(
set
==
NULL
)
{
set
=
"FAT"
;
fs_set
=
fs_info
;
}
else
{
fs_set
->
close
(
fs_set
);
fs_info
->
close
(
fs_info
);
tsk_error_reset
();
tsk_error_set_errno
(
TSK_ERR_FS_UNKTYPE
);
tsk_error_set_errstr
(
"FAT or %s"
,
set
);
return
NULL
;
}
}
else
{
tsk_error_reset
();
}
if
((
fs_info
=
ext2fs_open
(
a_img_info
,
a_offset
,
TSK_FS_TYPE_EXT_DETECT
,
1
))
!=
NULL
)
{
if
(
set
==
NULL
)
{
set
=
"EXT2/3"
;
fs_set
=
fs_info
;
}
else
{
fs_set
->
close
(
fs_set
);
fs_info
->
close
(
fs_info
);
tsk_error_reset
();
tsk_error_set_errno
(
TSK_ERR_FS_UNKTYPE
);
tsk_error_set_errstr
(
"EXT2/3 or %s"
,
set
);
return
NULL
;
}
}
else
{
tsk_error_reset
();
}
if
((
fs_info
=
ffs_open
(
a_img_info
,
a_offset
,
TSK_FS_TYPE_FFS_DETECT
))
!=
NULL
)
{
if
(
set
==
NULL
)
{
set
=
"UFS"
;
fs_set
=
fs_info
;
}
else
{
fs_set
->
close
(
fs_set
);
fs_info
->
close
(
fs_info
);
tsk_error_reset
();
tsk_error_set_errno
(
TSK_ERR_FS_UNKTYPE
);
tsk_error_set_errstr
(
"UFS or %s"
,
set
);
return
NULL
;
}
}
else
{
tsk_error_reset
();
}
if
((
fs_info
=
yaffs2_open
(
a_img_info
,
a_offset
,
TSK_FS_TYPE_YAFFS2_DETECT
,
1
))
!=
NULL
)
{
if
(
set
==
NULL
)
{
set
=
"YAFFS2"
;
fs_set
=
fs_info
;
}
else
{
fs_set
->
close
(
fs_set
);
fs_info
->
close
(
fs_info
);
tsk_error_reset
();
tsk_error_set_errno
(
TSK_ERR_FS_UNKTYPE
);
tsk_error_set_errstr
(
"YAFFS2 or %s"
,
set
);
return
NULL
;
}
}
else
{
tsk_error_reset
();
}
#if TSK_USE_HFS
#if TSK_USE_HFS
if
((
fs_info
=
{
"HFS"
,
hfs_open
,
TSK_FS_TYPE_HFS_DETECT
},
hfs_open
(
a_img_info
,
a_offset
,
TSK_FS_TYPE_HFS_DETECT
,
#endif
1
))
!=
NULL
)
{
{
"ISO9660"
,
iso9660_open
,
TSK_FS_TYPE_ISO9660_DETECT
}
if
(
set
==
NULL
)
{
};
set
=
"HFS"
;
fs_set
=
fs_info
;
for
(
int
i
=
0
;
i
<
sizeof
(
FS_OPENERS
)
/
sizeof
(
FS_OPENERS
[
0
]);
++
i
)
{
if
((
fs_info
=
FS_OPENERS
[
i
].
open
(
a_img_info
,
a_offset
,
FS_OPENERS
[
i
].
type
,
1
))
!=
NULL
)
{
// fs opens as type i
if
(
fs_first
==
NULL
)
{
// first success opening fs
name_first
=
FS_OPENERS
[
i
].
name
;
fs_first
=
fs_info
;
}
else
{
// second success opening fs, which means we
// cannot autodetect the fs type and must give up
fs_first
->
close
(
fs_first
);
fs_info
->
close
(
fs_info
);
tsk_error_reset
();
tsk_error_set_errno
(
TSK_ERR_FS_UNKTYPE
);
tsk_error_set_errstr
(
"%s or %s"
,
FS_OPENERS
[
i
].
name
,
name_first
);
return
NULL
;
}
}
}
else
{
else
{
fs_set
->
close
(
fs_set
);
// fs does not open as type i
fs_info
->
close
(
fs_info
);
tsk_error_reset
();
tsk_error_reset
();
tsk_error_set_errno
(
TSK_ERR_FS_UNKTYPE
);
tsk_error_set_errstr
(
"HFS or %s"
,
set
);
return
NULL
;
}
}
}
}
else
{
tsk_error_reset
();
}
#endif
if
((
fs_info
=
iso9660_open
(
a_img_info
,
a_offset
,
TSK_FS_TYPE_ISO9660_DETECT
,
1
))
!=
NULL
)
{
if
(
set
!=
NULL
)
{
fs_set
->
close
(
fs_set
);
fs_info
->
close
(
fs_info
);
tsk_error_reset
();
tsk_error_set_errno
(
TSK_ERR_FS_UNKTYPE
);
tsk_error_set_errstr
(
"ISO9660 or %s"
,
set
);
return
NULL
;
}
fs_set
=
fs_info
;
}
else
{
tsk_error_reset
();
}
if
(
fs_first
==
NULL
)
{
if
(
fs_set
==
NULL
)
{
tsk_error_reset
();
tsk_error_reset
();
tsk_error_set_errno
(
TSK_ERR_FS_UNKTYPE
);
tsk_error_set_errno
(
TSK_ERR_FS_UNKTYPE
);
return
NULL
;
}
}
return
fs_set
;
return
fs_first
;
}
}
else
{
else
{
if
(
TSK_FS_TYPE_ISNTFS
(
a_ftype
))
if
(
TSK_FS_TYPE_ISNTFS
(
a_ftype
))
...
@@ -246,7 +159,7 @@ tsk_fs_open_img(TSK_IMG_INFO * a_img_info, TSK_OFF_T a_offset,
...
@@ -246,7 +159,7 @@ tsk_fs_open_img(TSK_IMG_INFO * a_img_info, TSK_OFF_T a_offset,
else
if
(
TSK_FS_TYPE_ISFAT
(
a_ftype
))
else
if
(
TSK_FS_TYPE_ISFAT
(
a_ftype
))
return
fatfs_open
(
a_img_info
,
a_offset
,
a_ftype
,
0
);
return
fatfs_open
(
a_img_info
,
a_offset
,
a_ftype
,
0
);
else
if
(
TSK_FS_TYPE_ISFFS
(
a_ftype
))
else
if
(
TSK_FS_TYPE_ISFFS
(
a_ftype
))
return
ffs_open
(
a_img_info
,
a_offset
,
a_ftype
);
return
ffs_open
(
a_img_info
,
a_offset
,
a_ftype
,
0
);
else
if
(
TSK_FS_TYPE_ISEXT
(
a_ftype
))
else
if
(
TSK_FS_TYPE_ISEXT
(
a_ftype
))
return
ext2fs_open
(
a_img_info
,
a_offset
,
a_ftype
,
0
);
return
ext2fs_open
(
a_img_info
,
a_offset
,
a_ftype
,
0
);
else
if
(
TSK_FS_TYPE_ISHFS
(
a_ftype
))
else
if
(
TSK_FS_TYPE_ISHFS
(
a_ftype
))
...
...
This diff is collapsed.
Click to expand it.
tsk/fs/tsk_fs_i.h
+
1
−
1
View file @
1a432504
...
@@ -187,7 +187,7 @@ extern "C" {
...
@@ -187,7 +187,7 @@ extern "C" {
extern
TSK_FS_INFO
*
fatfs_open
(
TSK_IMG_INFO
*
,
TSK_OFF_T
,
extern
TSK_FS_INFO
*
fatfs_open
(
TSK_IMG_INFO
*
,
TSK_OFF_T
,
TSK_FS_TYPE_ENUM
,
uint8_t
);
TSK_FS_TYPE_ENUM
,
uint8_t
);
extern
TSK_FS_INFO
*
ffs_open
(
TSK_IMG_INFO
*
,
TSK_OFF_T
,
extern
TSK_FS_INFO
*
ffs_open
(
TSK_IMG_INFO
*
,
TSK_OFF_T
,
TSK_FS_TYPE_ENUM
);
TSK_FS_TYPE_ENUM
,
uint8_t
);
extern
TSK_FS_INFO
*
ntfs_open
(
TSK_IMG_INFO
*
,
TSK_OFF_T
,
extern
TSK_FS_INFO
*
ntfs_open
(
TSK_IMG_INFO
*
,
TSK_OFF_T
,
TSK_FS_TYPE_ENUM
,
uint8_t
);
TSK_FS_TYPE_ENUM
,
uint8_t
);
extern
TSK_FS_INFO
*
rawfs_open
(
TSK_IMG_INFO
*
,
TSK_OFF_T
);
extern
TSK_FS_INFO
*
rawfs_open
(
TSK_IMG_INFO
*
,
TSK_OFF_T
);
...
...
This diff is collapsed.
Click to expand it.
tsk/vs/mm_part.c
+
3
−
7
View file @
1a432504
...
@@ -272,13 +272,9 @@ tsk_vs_part_walk(TSK_VS_INFO * a_vs, TSK_PNUM_T a_start, TSK_PNUM_T a_last,
...
@@ -272,13 +272,9 @@ tsk_vs_part_walk(TSK_VS_INFO * a_vs, TSK_PNUM_T a_start, TSK_PNUM_T a_last,
for
(
part
=
a_vs
->
part_list
;
part
!=
NULL
;
part
=
part
->
next
)
{
for
(
part
=
a_vs
->
part_list
;
part
!=
NULL
;
part
=
part
->
next
)
{
if
((
part
->
addr
>=
a_start
)
&&
((
part
->
flags
&
a_flags
)
!=
0
))
{
if
((
part
->
addr
>=
a_start
)
&&
((
part
->
flags
&
a_flags
)
!=
0
))
{
int
retval
;
switch
(
a_action
(
a_vs
,
part
,
a_ptr
))
{
retval
=
a_action
(
a_vs
,
part
,
a_ptr
);
case
TSK_WALK_STOP
:
return
0
;
if
(
retval
==
TSK_WALK_STOP
)
{
case
TSK_WALK_ERROR
:
return
1
;
return
0
;
}
else
if
(
retval
==
TSK_WALK_ERROR
)
{
return
1
;
}
}
}
}
...
...
This diff is collapsed.
Click to expand it.
Preview
0%
Loading
Try again
or
attach a new file
.
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Save comment
Cancel
Please
register
or
sign in
to comment