From 4d816c6a822f0d209ab3a1e2f286e41085edaff5 Mon Sep 17 00:00:00 2001
From: Brian Carrier <carrier@sleuthkit.org>
Date: Thu, 5 Feb 2009 14:31:47 +0000
Subject: [PATCH] Potential fix for fs_attr_add and updated verbose debug
messages
---
tsk3/fs/fs_attr.c | 9 +++++++++
tsk3/fs/ntfs.c | 32 ++++++++++++++++----------------
2 files changed, 25 insertions(+), 16 deletions(-)
diff --git a/tsk3/fs/fs_attr.c b/tsk3/fs/fs_attr.c
index d1c9a9e74..f22cccde5 100644
--- a/tsk3/fs/fs_attr.c
+++ b/tsk3/fs/fs_attr.c
@@ -429,6 +429,13 @@ tsk_fs_attr_add_run(TSK_FS_INFO * a_fs, TSK_FS_ATTR * a_fs_attr,
data_run_prev = NULL;
while (data_run_cur) {
+ if (tsk_verbose)
+ tsk_fprintf(stderr,
+ "tsk_fs_attr_add: %" PRIuOFF "@%" PRIuOFF
+ " (Filler: %s)\n", data_run_cur->offset, data_run_cur->len,
+ (data_run_cur->
+ flags & TSK_FS_ATTR_RUN_FLAG_FILLER) ? "Yes" : "No");
+
/* Do we replace this filler spot? */
if (data_run_cur->flags & TSK_FS_ATTR_RUN_FLAG_FILLER) {
@@ -502,6 +509,8 @@ tsk_fs_attr_add_run(TSK_FS_INFO * a_fs, TSK_FS_ATTR * a_fs_attr,
else {
endrun->next = data_run_cur;
data_run_cur->len -= run_len;
+ data_run_cur->offset =
+ a_data_run_new->offset + a_data_run_new->len;
}
return 0;
diff --git a/tsk3/fs/ntfs.c b/tsk3/fs/ntfs.c
index be1b60274..3fd88d4c1 100644
--- a/tsk3/fs/ntfs.c
+++ b/tsk3/fs/ntfs.c
@@ -406,12 +406,14 @@ ntfs_dinode_lookup(NTFS_INFO * a_ntfs, ntfs_mft * a_mft,
new_val = &upd->upd_seq + (i - 1) * 2;
old_val = (uint8_t *) ((uintptr_t) a_mft + offset);
- if (tsk_verbose)
- tsk_fprintf(stderr,
- "ntfs_dinode_lookup: upd_seq %i Replacing: %.4"
- PRIx16 " With: %.4" PRIx16 "\n", i,
- tsk_getu16(fs->endian, old_val), tsk_getu16(fs->endian,
- new_val));
+ /*
+ if (tsk_verbose)
+ tsk_fprintf(stderr,
+ "ntfs_dinode_lookup: upd_seq %i Replacing: %.4"
+ PRIx16 " With: %.4" PRIx16 "\n", i,
+ tsk_getu16(fs->endian, old_val), tsk_getu16(fs->endian,
+ new_val));
+ */
*old_val++ = *new_val++;
*old_val = *new_val;
}
@@ -1562,7 +1564,7 @@ ntfs_proc_attrseq(NTFS_INFO * ntfs,
if (tsk_verbose)
tsk_fprintf(stderr,
- "ntfs_proc_attrseq: Processing entry %"
+ "ntfs_proc_attrseq: Processing extended entry for primary entry %"
PRIuINUM "\n", fs_file->meta->addr);
if (fs_file->meta->attr == NULL) {
@@ -1656,10 +1658,9 @@ ntfs_proc_attrseq(NTFS_INFO * ntfs,
if (tsk_verbose)
tsk_fprintf(stderr,
- "ntfs_proc_attrseq: Resident Attribute in %"
- PRIuINUM " Type: %" PRIu32 " Id: %"
- PRIu16 " Name: %s\n", ntfs->mnum,
- type, tsk_getu16(fs->endian, attr->id), name);
+ "ntfs_proc_attrseq: Resident Attribute in Type: %"
+ PRIu32 " Id: %" PRIu16 " Name: %s\n", type,
+ tsk_getu16(fs->endian, attr->id), name);
/* Validate the offset lengths */
if (((tsk_getu16(fs->endian,
@@ -1726,11 +1727,10 @@ ntfs_proc_attrseq(NTFS_INFO * ntfs,
if (tsk_verbose)
tsk_fprintf(stderr,
- "ntfs_proc_attrseq: Non-Resident Attribute in %"
- PRIuINUM " Type: %" PRIu32 " Id: %"
- PRIu16 " Name: %s Start VCN: %"
- PRIu64 "\n", ntfs->mnum, type, id,
- name, tsk_getu64(fs->endian, attr->c.nr.start_vcn));
+ "ntfs_proc_attrseq: Non-Resident Attribute Type: %"
+ PRIu32 " Id: %" PRIu16 " Name: %s Start VCN: %" PRIu64
+ "\n", type, id, name, tsk_getu64(fs->endian,
+ attr->c.nr.start_vcn));
/* convert the run to generic form */
retval = ntfs_make_data_run(ntfs,
--
GitLab