diff --git a/tsk3/auto/auto_db.cpp b/tsk3/auto/auto_db.cpp index ee703f3ff8855940bc0b89672aa1d61894fd5a10..5f0445ca137ed440cb594faf3f9bfc22c27634b4 100644 --- a/tsk3/auto/auto_db.cpp +++ b/tsk3/auto/auto_db.cpp @@ -547,6 +547,8 @@ TskAutoDb::processAttribute(TSK_FS_FILE * fs_file, if ((m_blkMapFlag) && (isNonResident(fs_attr)) && (isDotDir(fs_file, path) == 0)) { TSK_FS_ATTR_RUN *run; + int sequence = 0; + for (run = fs_attr->nrd.run; run != NULL; run = run->next) { unsigned int block_size = fs_file->fs_info->block_size; @@ -556,7 +558,7 @@ TskAutoDb::processAttribute(TSK_FS_FILE * fs_file, // @@@ We probaly want ot keep on going here if (m_db->addFsBlockInfo(m_curFsId, m_curFileId, - run->addr * block_size, run->len * block_size)) { + run->addr * block_size, run->len * block_size, sequence++)) { return TSK_ERR; } } diff --git a/tsk3/auto/db_sqlite.cpp b/tsk3/auto/db_sqlite.cpp index 05ca814d4470c3beedf311838e5a5bc6c62285bc..d902a07f0ebffa634c00ae57a61dbef201d8960b 100644 --- a/tsk3/auto/db_sqlite.cpp +++ b/tsk3/auto/db_sqlite.cpp @@ -242,7 +242,7 @@ int if (m_blkMapFlag) { if (attempt_exec - ("CREATE TABLE tsk_file_layout (fs_id INTEGER NOT NULL, byte_start INTEGER NOT NULL, byte_len INTEGER NOT NULL, obj_id);", + ("CREATE TABLE tsk_file_layout (fs_id INTEGER NOT NULL, byte_start INTEGER NOT NULL, byte_len INTEGER NOT NULL, obj_id INTEGER, sequence INTEGER);", "Error creating tsk_fs_blocks table: %s\n")) { return 1; } @@ -737,18 +737,19 @@ int * @param a_fileObjId ID of the file * @param a_byteStart Byte address relative to the start of the image file * @param a_byteLen Length of the run in bytes + * @param a_sequence Sequence of this run in the file * @returns 1 on error */ int TskDbSqlite::addFsBlockInfo(int64_t a_fsObjId, int64_t a_fileObjId, - uint64_t a_byteStart, uint64_t a_byteLen) + uint64_t a_byteStart, uint64_t a_byteLen, int a_sequence) { char foo[1024]; snprintf(foo, 1024, - "INSERT INTO tsk_file_layout (fs_id, byte_start, byte_len, obj_id) VALUES (%lld, %lld, %llu, %llu)", - a_fsObjId, a_byteStart, a_byteLen, a_fileObjId); + "INSERT INTO tsk_file_layout (fs_id, byte_start, byte_len, obj_id, sequence) VALUES (%lld, %lld, %llu, %llu, %d)", + a_fsObjId, a_byteStart, a_byteLen, a_fileObjId, a_sequence); return attempt_exec(foo, "Error adding data to tsk_fs_info table: %s\n"); diff --git a/tsk3/auto/tsk_db_sqlite.h b/tsk3/auto/tsk_db_sqlite.h index ffb8ade759d11398fb0dd2de0132c0dab87bf80c..dd67f61d68637d019dc0b8dcedba4cb026623420 100755 --- a/tsk3/auto/tsk_db_sqlite.h +++ b/tsk3/auto/tsk_db_sqlite.h @@ -61,7 +61,7 @@ class TskDbSqlite { const TSK_AUTO_CASE_KNOWN_FILE_ENUM known, int64_t fsObjId, int64_t & objId); int addFsBlockInfo(int64_t a_fsObjId, int64_t a_fileObjId, - uint64_t a_byteStart, uint64_t a_byteLen); + uint64_t a_byteStart, uint64_t a_byteLen, int a_sequence); bool dbExist() const; int createSavepoint(const char *name);