diff --git a/tsk3/fs/fs_attr.c b/tsk3/fs/fs_attr.c index d1c9a9e743f301c9a0d2ead32285addce278d4b3..f22cccde5526310039c00f946a41fb31b575940c 100644 --- a/tsk3/fs/fs_attr.c +++ b/tsk3/fs/fs_attr.c @@ -429,6 +429,13 @@ tsk_fs_attr_add_run(TSK_FS_INFO * a_fs, TSK_FS_ATTR * a_fs_attr, data_run_prev = NULL; while (data_run_cur) { + if (tsk_verbose) + tsk_fprintf(stderr, + "tsk_fs_attr_add: %" PRIuOFF "@%" PRIuOFF + " (Filler: %s)\n", data_run_cur->offset, data_run_cur->len, + (data_run_cur-> + flags & TSK_FS_ATTR_RUN_FLAG_FILLER) ? "Yes" : "No"); + /* Do we replace this filler spot? */ if (data_run_cur->flags & TSK_FS_ATTR_RUN_FLAG_FILLER) { @@ -502,6 +509,8 @@ tsk_fs_attr_add_run(TSK_FS_INFO * a_fs, TSK_FS_ATTR * a_fs_attr, else { endrun->next = data_run_cur; data_run_cur->len -= run_len; + data_run_cur->offset = + a_data_run_new->offset + a_data_run_new->len; } return 0; diff --git a/tsk3/fs/ntfs.c b/tsk3/fs/ntfs.c index be1b6027460eac9e54a34d1bec495d17965acb06..3fd88d4c13052cbec6712afd682da91a9e00242c 100644 --- a/tsk3/fs/ntfs.c +++ b/tsk3/fs/ntfs.c @@ -406,12 +406,14 @@ ntfs_dinode_lookup(NTFS_INFO * a_ntfs, ntfs_mft * a_mft, new_val = &upd->upd_seq + (i - 1) * 2; old_val = (uint8_t *) ((uintptr_t) a_mft + offset); - if (tsk_verbose) - tsk_fprintf(stderr, - "ntfs_dinode_lookup: upd_seq %i Replacing: %.4" - PRIx16 " With: %.4" PRIx16 "\n", i, - tsk_getu16(fs->endian, old_val), tsk_getu16(fs->endian, - new_val)); + /* + if (tsk_verbose) + tsk_fprintf(stderr, + "ntfs_dinode_lookup: upd_seq %i Replacing: %.4" + PRIx16 " With: %.4" PRIx16 "\n", i, + tsk_getu16(fs->endian, old_val), tsk_getu16(fs->endian, + new_val)); + */ *old_val++ = *new_val++; *old_val = *new_val; } @@ -1562,7 +1564,7 @@ ntfs_proc_attrseq(NTFS_INFO * ntfs, if (tsk_verbose) tsk_fprintf(stderr, - "ntfs_proc_attrseq: Processing entry %" + "ntfs_proc_attrseq: Processing extended entry for primary entry %" PRIuINUM "\n", fs_file->meta->addr); if (fs_file->meta->attr == NULL) { @@ -1656,10 +1658,9 @@ ntfs_proc_attrseq(NTFS_INFO * ntfs, if (tsk_verbose) tsk_fprintf(stderr, - "ntfs_proc_attrseq: Resident Attribute in %" - PRIuINUM " Type: %" PRIu32 " Id: %" - PRIu16 " Name: %s\n", ntfs->mnum, - type, tsk_getu16(fs->endian, attr->id), name); + "ntfs_proc_attrseq: Resident Attribute in Type: %" + PRIu32 " Id: %" PRIu16 " Name: %s\n", type, + tsk_getu16(fs->endian, attr->id), name); /* Validate the offset lengths */ if (((tsk_getu16(fs->endian, @@ -1726,11 +1727,10 @@ ntfs_proc_attrseq(NTFS_INFO * ntfs, if (tsk_verbose) tsk_fprintf(stderr, - "ntfs_proc_attrseq: Non-Resident Attribute in %" - PRIuINUM " Type: %" PRIu32 " Id: %" - PRIu16 " Name: %s Start VCN: %" - PRIu64 "\n", ntfs->mnum, type, id, - name, tsk_getu64(fs->endian, attr->c.nr.start_vcn)); + "ntfs_proc_attrseq: Non-Resident Attribute Type: %" + PRIu32 " Id: %" PRIu16 " Name: %s Start VCN: %" PRIu64 + "\n", type, id, name, tsk_getu64(fs->endian, + attr->c.nr.start_vcn)); /* convert the run to generic form */ retval = ntfs_make_data_run(ntfs,