update for 2677107 to allow support for all AFFLIB formats.

CHANGES.txt

@@ -83,6 +83,9 @@ img_open functions.
 5/26/09: Bug Fix. Resolved issue 2796945 for inifite loop in fs_attr. 
 Reported by Simson Garfinkel.
 
+5/29/09: Update: Added feature 2677107 that allows support for all
+image formats supported by AFFLIB.
+
 
 ---------------- VERSION 3.0.1 -------------- 
 11/11/08: Bug Fix: Fixed crashing bug in ifind on FAT file system.

tsk3/img/aff.c

@@ -98,11 +98,15 @@ aff_imgstat(TSK_IMG_INFO * img_info, FILE * hFile)
         tsk_fprintf(hFile, "AFM\n");
         break;
     default:
-        tsk_fprintf(hFile, "?\n");
+        tsk_fprintf(hFile, "AFFLIB (%d)\n", aff_info->type);
         break;
     }
 
     tsk_fprintf(hFile, "\nSize in bytes: %" PRIuOFF "\n", img_info->size);
+    
+    // we won't have the rest of the info for the non-AFF formats.
+    if (img_info->itype == TSK_IMG_TYPE_AFF_ANY)
+        return;
 
     tsk_fprintf(hFile, "\nMD5: ");
     if (af_get_seg(aff_info->af_file, AF_MD5, NULL, buf, &buf_len) == 0) {
@@ -260,19 +264,8 @@ aff_open(const char *const images[])
     else if (type == AF_IDENTIFY_AFM) {
         img_info->itype = TSK_IMG_TYPE_AFF_AFM;
     }
-//    else if ((type == AF_IDENTIFY_EVF) || (type ==AF_IDENTIFY_EVD  )) {
-//      img_info->itype = TSK_IMG_TYPE_AFF_AFF;
-    //   }
     else {
-        tsk_error_reset();
-        tsk_errno = TSK_ERR_IMG_MAGIC;
-        snprintf(tsk_errstr, TSK_ERRSTR_L,
-            "aff_open: Not an AFF, AFD, or AFM file");
-        free(aff_info);
-        if (tsk_verbose)
-            tsk_fprintf(stderr, "Not an AFF/AFD/AFM file\n");
-
-        return NULL;
+        img_info->itype = TSK_IMG_TYPE_AFF_ANY;
     }
 
     aff_info->af_file = af_open(images[0], O_RDONLY | O_BINARY, 0);

tsk3/img/img_open.c

@@ -151,8 +151,15 @@ tsk_img_open(int num_img,
         /* Try the non-raw formats first */
 #if HAVE_LIBAFFLIB
         if ((img_info = aff_open(images)) != NULL) {
-            set = "AFF";
-            img_set = img_info;
+            /* we don't allow the "ANY" when autodetect is used because
+             * we only want to detect the tested formats. */
+            if (img_info->itype == TSK_IMG_TYPE_AFF_ANY) {
+                img_info->close(img_info);
+            }
+            else {
+                set = "AFF";
+                img_set = img_info;
+            }
         }
         else {
             tsk_error_reset();
@@ -234,6 +241,7 @@ tsk_img_open(int num_img,
     case TSK_IMG_TYPE_AFF_AFF:
     case TSK_IMG_TYPE_AFF_AFD:
     case TSK_IMG_TYPE_AFF_AFM:
+    case TSK_IMG_TYPE_AFF_ANY:
         img_info = aff_open(images);
         break;
 #endif

tsk3/img/img_types.c

@@ -34,6 +34,7 @@ static IMG_TYPES img_open_table[] = {
     {"aff", TSK_IMG_TYPE_AFF_AFF, "Advanced Forensic Format"},
     {"afd", TSK_IMG_TYPE_AFF_AFD, "AFF Multiple File"},
     {"afm", TSK_IMG_TYPE_AFF_AFM, "AFF with external metadata"},
+    {"afflib", TSK_IMG_TYPE_AFF_ANY, "All AFFLIB image formats (including beta ones)"},
 #endif
 #if HAVE_LIBEWF
     {"ewf", TSK_IMG_TYPE_EWF_EWF, "Expert Witness format (encase)"},

tsk3/img/tsk_img.h

@@ -37,7 +37,8 @@ extern "C" {
      * Macro that takes a image type and returns 1 if the type
      * is for an AFF file format. */
 #define TSK_IMG_TYPE_ISAFF(t) \
-    ((((t) & TSK_IMG_TYPE_AFF_AFF) || ((t) & TSK_IMG_TYPE_AFF_AFD)  || ((t) & TSK_IMG_TYPE_AFF_AFM))?1:0)
+    ((((t) & TSK_IMG_TYPE_AFF_AFF) || ((t) & TSK_IMG_TYPE_AFF_AFD)  || ((t) & TSK_IMG_TYPE_AFF_AFM) || \
+    ((t) & TSK_IMG_TYPE_AFF_ANY))?1:0)
 
     /**
      * \ingroup imglib
@@ -61,8 +62,9 @@ extern "C" {
         TSK_IMG_TYPE_AFF_AFF = 0x0004,  ///< AFF AFF Format
         TSK_IMG_TYPE_AFF_AFD = 0x0008,  ///< AFD AFF Format
         TSK_IMG_TYPE_AFF_AFM = 0x0010,  ///< AFM AFF Format
+        TSK_IMG_TYPE_AFF_ANY = 0x0020,  ///< Any format supported by AFFLIB (including beta ones)
 
-        TSK_IMG_TYPE_EWF_EWF = 0x0020,  ///< EWF version
+        TSK_IMG_TYPE_EWF_EWF = 0x0040,  ///< EWF version
 
         TSK_IMG_TYPE_UNSUPP = 0xffff,   ///< Unsupported disk image type
     } TSK_IMG_TYPE_ENUM;
@@ -85,7 +87,7 @@ extern "C" {
         int cache_age[TSK_IMG_INFO_CACHE_NUM];  ///< "Age" of corresponding cache entry, higher means more recently used
         size_t cache_len[TSK_IMG_INFO_CACHE_NUM];       ///< Length of cache entry used (0 if never used)
 
-         ssize_t(*read) (TSK_IMG_INFO * img, TSK_OFF_T off, char *buf, size_t len);     ///< \internal External progs should call tsk_img_read() 
+        ssize_t(*read) (TSK_IMG_INFO * img, TSK_OFF_T off, char *buf, size_t len);     ///< \internal External progs should call tsk_img_read() 
         void (*close) (TSK_IMG_INFO *); ///< \internal Progs should call tsk_img_close()
         void (*imgstat) (TSK_IMG_INFO *, FILE *);       ///< Pointer to file type specific function
     };

xcode/sleuthkit.xcodeproj/project.pbxproj

@@ -475,9 +475,11 @@
 		026FB3830D19C831000434C7 /* Project object */ = {
 			isa = PBXProject;
 			buildConfigurationList = 026FB3840D19C831000434C7 /* Build configuration list for PBXProject "sleuthkit" */;
+			compatibilityVersion = "Xcode 2.4";
 			hasScannedForEncodings = 0;
 			mainGroup = 026FB3810D19C831000434C7;
 			projectDirPath = "";
+			projectRoot = "";
 			targets = (
 				02DC8CFF0ED0A60E00BFCE0B /* libtsk */,
 				02DC8D4E0ED0A7AF00BFCE0B /* tools */,