From 337fd1da027e596b43865252e216a24b1ac05f5b Mon Sep 17 00:00:00 2001 From: Brian Carrier <carrier@sleuthkit.org> Date: Wed, 22 Apr 2009 00:59:33 +0000 Subject: [PATCH] fix for 2777633 re: FAT creation time resolution --- CHANGES.txt | 3 +++ tsk3/fs/fatfs_meta.c | 13 +++++++++---- tsk3/fs/tsk_fatfs.h | 2 +- 3 files changed, 13 insertions(+), 5 deletions(-) diff --git a/CHANGES.txt b/CHANGES.txt index 586d604e5..e5c1cb4d2 100644 --- a/CHANGES.txt +++ b/CHANGES.txt @@ -74,6 +74,9 @@ when reading the raw character device. patch by Rob Joyce. 4/21/09: Bug Fix. Fixed issue 2778170 re: incorrect read size on resident attributes. Patch by Jamie Butler. +4/21/09: Bug Fix. Fixed issue 2777633 re: missing second resolution on FAT +creation times. Reported by Eoghan Casey. + ---------------- VERSION 3.0.0 -------------- 0/00/00: Update: Many, many, many API changes. diff --git a/tsk3/fs/fatfs_meta.c b/tsk3/fs/fatfs_meta.c index 4c10ebc3d..a34c93dda 100644 --- a/tsk3/fs/fatfs_meta.c +++ b/tsk3/fs/fatfs_meta.c @@ -95,7 +95,7 @@ is_83_name(fatfs_dentry * de) ** */ static time_t -dos2unixtime(uint16_t date, uint16_t time) +dos2unixtime(uint16_t date, uint16_t time, uint8_t timetens) { struct tm tm1; time_t ret; @@ -108,6 +108,9 @@ dos2unixtime(uint16_t date, uint16_t time) tm1.tm_sec = ((time & FATFS_SEC_MASK) >> FATFS_SEC_SHIFT) * 2; if ((tm1.tm_sec < 0) || (tm1.tm_sec > 60)) tm1.tm_sec = 0; + // the ctimetens value has a range of 0 to 199 + if (timetens > 100) + tm1.tm_sec++; tm1.tm_min = ((time & FATFS_MIN_MASK) >> FATFS_MIN_SHIFT); if ((tm1.tm_min < 0) || (tm1.tm_min > 59)) @@ -273,13 +276,13 @@ fatfs_dinode_copy(FATFS_INFO * fatfs, TSK_FS_META * fs_meta, if (FATFS_ISDATE(tsk_getu16(fs->endian, in->wdate))) fs_meta->mtime = dos2unixtime(tsk_getu16(fs->endian, in->wdate), - tsk_getu16(fs->endian, in->wtime)); + tsk_getu16(fs->endian, in->wtime), 0); else fs_meta->mtime = 0; if (FATFS_ISDATE(tsk_getu16(fs->endian, in->adate))) fs_meta->atime = - dos2unixtime(tsk_getu16(fs->endian, in->adate), 0); + dos2unixtime(tsk_getu16(fs->endian, in->adate), 0, 0); else fs_meta->atime = 0; @@ -291,7 +294,7 @@ fatfs_dinode_copy(FATFS_INFO * fatfs, TSK_FS_META * fs_meta, if (FATFS_ISDATE(tsk_getu16(fs->endian, in->cdate))) fs_meta->crtime = dos2unixtime(tsk_getu16(fs->endian, in->cdate), - tsk_getu16(fs->endian, in->ctime)); + tsk_getu16(fs->endian, in->ctime), in->ctimeten); else fs_meta->crtime = 0; @@ -753,6 +756,8 @@ fatfs_isdentry(FATFS_INFO * fatfs, fatfs_dentry * de) else if ((tsk_getu16(fs->endian, de->cdate) != 0) && (FATFS_ISDATE(tsk_getu16(fs->endian, de->cdate)) == 0)) return 0; + else if (de->ctimeten > 200) + return 0; else if ((tsk_getu16(fs->endian, de->adate) != 0) && (FATFS_ISDATE(tsk_getu16(fs->endian, de->adate)) == 0)) return 0; diff --git a/tsk3/fs/tsk_fatfs.h b/tsk3/fs/tsk_fatfs.h index aadf20426..8d693ca0c 100644 --- a/tsk3/fs/tsk_fatfs.h +++ b/tsk3/fs/tsk_fatfs.h @@ -176,7 +176,7 @@ extern "C" { uint8_t ext[3]; uint8_t attrib; uint8_t lowercase; - uint8_t ctimeten; /* create times */ + uint8_t ctimeten; /* create times (ctimeten is 0-199) */ uint8_t ctime[2]; uint8_t cdate[2]; uint8_t adate[2]; /* access time */ -- GitLab