diff --git a/bindings/java/jni/dataModel_SleuthkitJNI.cpp b/bindings/java/jni/dataModel_SleuthkitJNI.cpp index 0e616dbad8d48d72916cab90e24d121908a0ac44..c75bab7e9d5fa94fb0c23c63a598b4cd63789b8c 100644 --- a/bindings/java/jni/dataModel_SleuthkitJNI.cpp +++ b/bindings/java/jni/dataModel_SleuthkitJNI.cpp @@ -1724,7 +1724,7 @@ Java_org_sleuthkit_datamodel_SleuthkitJNI_readFileNat(JNIEnv * env, TSK_OFF_T readOffset = (TSK_OFF_T) offset; if(offset_type == TSK_FS_FILE_READ_OFFSET_TYPE_START_OF_SLACK){ readFlag = TSK_FS_FILE_READ_FLAG_SLACK; - readOffset += tsk_fs_attr->size; + readOffset += tsk_fs_attr->nrd.initsize; } //read attribute diff --git a/tsk/auto/db_postgresql.cpp b/tsk/auto/db_postgresql.cpp index 6b237a0672568351d2b752835ad69214dbc7b025..9c39022aa76e7ac2fb6a488a863e28b9fcf0bfb4 100755 --- a/tsk/auto/db_postgresql.cpp +++ b/tsk/auto/db_postgresql.cpp @@ -1060,15 +1060,16 @@ int TskDbPostgreSQL::addFile(TSK_FS_FILE * fs_file, const TSK_FS_ATTR * fs_attr, // Add entry for the slack space. // Current conditions for creating a slack file: // - Data is non-resident - // - The allocated size is greater than the file size + // - The allocated size is greater than the initialized file size + // See github issue #756 on why initsize and not size. // - The data is not compressed if((fs_attr != NULL) && (! (fs_file->meta->flags & TSK_FS_META_FLAG_COMP)) && (fs_attr->flags & TSK_FS_ATTR_NONRES) - && (fs_attr->nrd.allocsize > fs_attr->size)){ + && (fs_attr->nrd.allocsize > fs_attr->nrd.initsize)){ strncat(name, "-slack", 6); name_sql = PQescapeLiteral(conn, name, strlen(name)); - TSK_OFF_T slackSize = fs_attr->nrd.allocsize - fs_attr->size; + TSK_OFF_T slackSize = fs_attr->nrd.allocsize - fs_attr->nrd.initsize; if (addObject(TSK_DB_OBJECT_TYPE_FILE, parObjId, objId)) { free(name); diff --git a/tsk/auto/db_sqlite.cpp b/tsk/auto/db_sqlite.cpp index ef84c7515074e5a49350cdd93e269304c3c4d328..207be5a10a2f600df43e6f327510903241ec338f 100755 --- a/tsk/auto/db_sqlite.cpp +++ b/tsk/auto/db_sqlite.cpp @@ -993,14 +993,15 @@ int // Add entry for the slack space. // Current conditions for creating a slack file: // - Data is non-resident - // - The allocated size is greater than the file size + // - The allocated size is greater than the initialized file size + // See github issue #756 on why initsize and not size. // - The data is not compressed if((fs_attr != NULL) && (!(fs_file->meta->flags & TSK_FS_META_FLAG_COMP)) && (fs_attr->flags & TSK_FS_ATTR_NONRES) - && (fs_attr->nrd.allocsize > fs_attr->size)){ + && (fs_attr->nrd.allocsize > fs_attr->nrd.initsize)){ strncat(name, "-slack", 6); - TSK_OFF_T slackSize = fs_attr->nrd.allocsize - fs_attr->size; + TSK_OFF_T slackSize = fs_attr->nrd.allocsize - fs_attr->nrd.initsize; if (addObject(TSK_DB_OBJECT_TYPE_FILE, parObjId, objId)) { free(name);