From 37e5f816beedfc338e4422189a186d5aeebf96ba Mon Sep 17 00:00:00 2001
From: Brian Carrier <carrier@sleuthkit.org>
Date: Fri, 29 May 2009 17:05:52 +0000
Subject: [PATCH] update for 2677107 to allow support for all AFFLIB formats.
---
CHANGES.txt | 3 +++
tsk3/img/aff.c | 19 ++++++-------------
tsk3/img/img_open.c | 12 ++++++++++--
tsk3/img/img_types.c | 1 +
tsk3/img/tsk_img.h | 8 +++++---
xcode/sleuthkit.xcodeproj/project.pbxproj | 2 ++
6 files changed, 27 insertions(+), 18 deletions(-)
diff --git a/CHANGES.txt b/CHANGES.txt
index fd8019891..ac114d1ca 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -83,6 +83,9 @@ img_open functions.
5/26/09: Bug Fix. Resolved issue 2796945 for inifite loop in fs_attr.
Reported by Simson Garfinkel.
+5/29/09: Update: Added feature 2677107 that allows support for all
+image formats supported by AFFLIB.
+
---------------- VERSION 3.0.1 --------------
11/11/08: Bug Fix: Fixed crashing bug in ifind on FAT file system.
diff --git a/tsk3/img/aff.c b/tsk3/img/aff.c
index 2d2dd6a32..2813fbf49 100644
--- a/tsk3/img/aff.c
+++ b/tsk3/img/aff.c
@@ -98,11 +98,15 @@ aff_imgstat(TSK_IMG_INFO * img_info, FILE * hFile)
tsk_fprintf(hFile, "AFM\n");
break;
default:
- tsk_fprintf(hFile, "?\n");
+ tsk_fprintf(hFile, "AFFLIB (%d)\n", aff_info->type);
break;
}
tsk_fprintf(hFile, "\nSize in bytes: %" PRIuOFF "\n", img_info->size);
+
+ // we won't have the rest of the info for the non-AFF formats.
+ if (img_info->itype == TSK_IMG_TYPE_AFF_ANY)
+ return;
tsk_fprintf(hFile, "\nMD5: ");
if (af_get_seg(aff_info->af_file, AF_MD5, NULL, buf, &buf_len) == 0) {
@@ -260,19 +264,8 @@ aff_open(const char *const images[])
else if (type == AF_IDENTIFY_AFM) {
img_info->itype = TSK_IMG_TYPE_AFF_AFM;
}
-// else if ((type == AF_IDENTIFY_EVF) || (type ==AF_IDENTIFY_EVD )) {
-// img_info->itype = TSK_IMG_TYPE_AFF_AFF;
- // }
else {
- tsk_error_reset();
- tsk_errno = TSK_ERR_IMG_MAGIC;
- snprintf(tsk_errstr, TSK_ERRSTR_L,
- "aff_open: Not an AFF, AFD, or AFM file");
- free(aff_info);
- if (tsk_verbose)
- tsk_fprintf(stderr, "Not an AFF/AFD/AFM file\n");
-
- return NULL;
+ img_info->itype = TSK_IMG_TYPE_AFF_ANY;
}
aff_info->af_file = af_open(images[0], O_RDONLY | O_BINARY, 0);
diff --git a/tsk3/img/img_open.c b/tsk3/img/img_open.c
index 105d1cad5..b28720526 100644
--- a/tsk3/img/img_open.c
+++ b/tsk3/img/img_open.c
@@ -151,8 +151,15 @@ tsk_img_open(int num_img,
/* Try the non-raw formats first */
#if HAVE_LIBAFFLIB
if ((img_info = aff_open(images)) != NULL) {
- set = "AFF";
- img_set = img_info;
+ /* we don't allow the "ANY" when autodetect is used because
+ * we only want to detect the tested formats. */
+ if (img_info->itype == TSK_IMG_TYPE_AFF_ANY) {
+ img_info->close(img_info);
+ }
+ else {
+ set = "AFF";
+ img_set = img_info;
+ }
}
else {
tsk_error_reset();
@@ -234,6 +241,7 @@ tsk_img_open(int num_img,
case TSK_IMG_TYPE_AFF_AFF:
case TSK_IMG_TYPE_AFF_AFD:
case TSK_IMG_TYPE_AFF_AFM:
+ case TSK_IMG_TYPE_AFF_ANY:
img_info = aff_open(images);
break;
#endif
diff --git a/tsk3/img/img_types.c b/tsk3/img/img_types.c
index 2e24aff53..82e04bd1f 100644
--- a/tsk3/img/img_types.c
+++ b/tsk3/img/img_types.c
@@ -34,6 +34,7 @@ static IMG_TYPES img_open_table[] = {
{"aff", TSK_IMG_TYPE_AFF_AFF, "Advanced Forensic Format"},
{"afd", TSK_IMG_TYPE_AFF_AFD, "AFF Multiple File"},
{"afm", TSK_IMG_TYPE_AFF_AFM, "AFF with external metadata"},
+ {"afflib", TSK_IMG_TYPE_AFF_ANY, "All AFFLIB image formats (including beta ones)"},
#endif
#if HAVE_LIBEWF
{"ewf", TSK_IMG_TYPE_EWF_EWF, "Expert Witness format (encase)"},
diff --git a/tsk3/img/tsk_img.h b/tsk3/img/tsk_img.h
index 1d457dfe2..c519a3fd7 100644
--- a/tsk3/img/tsk_img.h
+++ b/tsk3/img/tsk_img.h
@@ -37,7 +37,8 @@ extern "C" {
* Macro that takes a image type and returns 1 if the type
* is for an AFF file format. */
#define TSK_IMG_TYPE_ISAFF(t) \
- ((((t) & TSK_IMG_TYPE_AFF_AFF) || ((t) & TSK_IMG_TYPE_AFF_AFD) || ((t) & TSK_IMG_TYPE_AFF_AFM))?1:0)
+ ((((t) & TSK_IMG_TYPE_AFF_AFF) || ((t) & TSK_IMG_TYPE_AFF_AFD) || ((t) & TSK_IMG_TYPE_AFF_AFM) || \
+ ((t) & TSK_IMG_TYPE_AFF_ANY))?1:0)
/**
* \ingroup imglib
@@ -61,8 +62,9 @@ extern "C" {
TSK_IMG_TYPE_AFF_AFF = 0x0004, ///< AFF AFF Format
TSK_IMG_TYPE_AFF_AFD = 0x0008, ///< AFD AFF Format
TSK_IMG_TYPE_AFF_AFM = 0x0010, ///< AFM AFF Format
+ TSK_IMG_TYPE_AFF_ANY = 0x0020, ///< Any format supported by AFFLIB (including beta ones)
- TSK_IMG_TYPE_EWF_EWF = 0x0020, ///< EWF version
+ TSK_IMG_TYPE_EWF_EWF = 0x0040, ///< EWF version
TSK_IMG_TYPE_UNSUPP = 0xffff, ///< Unsupported disk image type
} TSK_IMG_TYPE_ENUM;
@@ -85,7 +87,7 @@ extern "C" {
int cache_age[TSK_IMG_INFO_CACHE_NUM]; ///< "Age" of corresponding cache entry, higher means more recently used
size_t cache_len[TSK_IMG_INFO_CACHE_NUM]; ///< Length of cache entry used (0 if never used)
- ssize_t(*read) (TSK_IMG_INFO * img, TSK_OFF_T off, char *buf, size_t len); ///< \internal External progs should call tsk_img_read()
+ ssize_t(*read) (TSK_IMG_INFO * img, TSK_OFF_T off, char *buf, size_t len); ///< \internal External progs should call tsk_img_read()
void (*close) (TSK_IMG_INFO *); ///< \internal Progs should call tsk_img_close()
void (*imgstat) (TSK_IMG_INFO *, FILE *); ///< Pointer to file type specific function
};
diff --git a/xcode/sleuthkit.xcodeproj/project.pbxproj b/xcode/sleuthkit.xcodeproj/project.pbxproj
index e86e546b1..140909f76 100644
--- a/xcode/sleuthkit.xcodeproj/project.pbxproj
+++ b/xcode/sleuthkit.xcodeproj/project.pbxproj
@@ -475,9 +475,11 @@
026FB3830D19C831000434C7 /* Project object */ = {
isa = PBXProject;
buildConfigurationList = 026FB3840D19C831000434C7 /* Build configuration list for PBXProject "sleuthkit" */;
+ compatibilityVersion = "Xcode 2.4";
hasScannedForEncodings = 0;
mainGroup = 026FB3810D19C831000434C7;
projectDirPath = "";
+ projectRoot = "";
targets = (
02DC8CFF0ED0A60E00BFCE0B /* libtsk */,
02DC8D4E0ED0A7AF00BFCE0B /* tools */,
--
GitLab