diff --git a/bindings/java/test/org/sleuthkit/datamodel/BottomUpTest.java b/bindings/java/test/org/sleuthkit/datamodel/BottomUpTest.java
index 38db43ee8aca1644bac21195cd51397b9581e82e..6eba8503cb8c9e6fee35ec6311fc1b0304082888 100644
--- a/bindings/java/test/org/sleuthkit/datamodel/BottomUpTest.java
+++ b/bindings/java/test/org/sleuthkit/datamodel/BottomUpTest.java
@@ -71,9 +71,9 @@ public static Collection<Object[]> testImageData() {
@Test
public void testBottomUpDiff() {
String title = DataModelTestSuite.getImgName(imagePaths.get(0));
- String exFile = DataModelTestSuite.buildPath(DataModelTestSuite.getRsltPath(), title, DataModelTestSuite.BTTMUP, ".txt");
+ String exFile = DataModelTestSuite.buildPath(DataModelTestSuite.getRsltDirPath(), title, DataModelTestSuite.BTTMUP, ".txt");
try {
- java.io.File dbFile = new java.io.File(DataModelTestSuite.getRsltPath());
+ java.io.File dbFile = new java.io.File(DataModelTestSuite.getRsltDirPath());
String tempDirPath = dbFile.getAbsolutePath();
String dbPath = DataModelTestSuite.buildPath(tempDirPath, title, DataModelTestSuite.BTTMUP, ".db");
dbFile.delete();
diff --git a/bindings/java/test/org/sleuthkit/datamodel/CPPtoJavaCompare.java b/bindings/java/test/org/sleuthkit/datamodel/CPPtoJavaCompare.java
index 16b21e44bedb53df6a3e0201eedf606896ecb4d4..fd7caa41074e324aa1487c2fb988aba6a6e8ed8b 100644
--- a/bindings/java/test/org/sleuthkit/datamodel/CPPtoJavaCompare.java
+++ b/bindings/java/test/org/sleuthkit/datamodel/CPPtoJavaCompare.java
@@ -77,8 +77,14 @@ public void testCppToJavaDiff() {
try {
// generate the C++ output and store it in gold standard -- even though it won't be checked in -- redesign this!
String standardPathCPP = DataModelTestSuite.standardFilePath(imagePaths, DataModelTestSuite.CPP);
+ java.io.File tskOutFile = new java.io.File(standardPathCPP);
+ // get rid of copy from previous runs
+ tskOutFile.delete();
+
runTskGetTimes(standardPathCPP, imagePaths);
+ assertTrue ("TSK gettimes output is zero sized (" + standardPathCPP + ")", tskOutFile.length() > 0);
+
// perform test
List<Boolean> test = basicTest();
diff --git a/bindings/java/test/org/sleuthkit/datamodel/CrossCompare.java b/bindings/java/test/org/sleuthkit/datamodel/CrossCompare.java
index 3ef1f695f5c08ee320f8310ba7349781a2ce2f9f..90576134b006f76b1afc3e5c2c07f210e1947aba 100644
--- a/bindings/java/test/org/sleuthkit/datamodel/CrossCompare.java
+++ b/bindings/java/test/org/sleuthkit/datamodel/CrossCompare.java
@@ -29,18 +29,16 @@
/**
*
* Ensures that a sequential traversal of a given image produces the same result
- * as a Top Down depth first traversal.
+ * as a Top Down traversal. Does not use gold standard files. It compares
+ * the outputs from the two test runs.
*/
@RunWith(Parameterized.class)
public class CrossCompare {
private List<String> imagePaths;
- private String Seq, TD;
- public CrossCompare(List<String> imagePaths, String Seq, String TD) {
+ public CrossCompare(List<String> imagePaths) {
this.imagePaths = imagePaths;
- this.Seq = Seq;
- this.TD = TD;
}
/**
@@ -56,7 +54,7 @@ public static Collection<Object[]> testImageData() {
Collection<Object[]> data = new ArrayList<Object[]>();
for (Object imagePaths : DataModelTestSuite.getImagePaths()) {
- data.add(new Object[]{imagePaths, DataModelTestSuite.SEQ, DataModelTestSuite.TD});
+ data.add(new Object[]{imagePaths});
}
return data;
}
@@ -66,17 +64,14 @@ public static Collection<Object[]> testImageData() {
* other
*/
@Test
- public void CrossCompare() {
+ public void testCrossCompareDiff() {
try {
- String title = DataModelTestSuite.getImgName(imagePaths.get(0));
- java.io.File testFolder = new java.io.File(DataModelTestSuite.getRsltPath());
- java.io.File testStandard1 = new java.io.File(DataModelTestSuite.buildPath(testFolder.getAbsolutePath(), title, Seq, "_SRT.txt"));
- java.io.File testStandard2 = new java.io.File(DataModelTestSuite.buildPath(testFolder.getAbsolutePath(), title, TD, "_SRT.txt"));
- String testStandardPath1 = testStandard1.getPath();
- String testStandardPath2 = testStandard2.getPath();
- assertEquals("Generated results (" + testStandardPath1 + ") differ with gold standard (" + testStandardPath2 + ") .", DataModelTestSuite.comparecontent(testStandardPath1, testStandardPath2), true);
+ String seqSortedOutputFile = DataModelTestSuite.sortedFlPth(DataModelTestSuite.resultFilePath(imagePaths, DataModelTestSuite.SEQ));
+ String tdSortedOutputFile = DataModelTestSuite.sortedFlPth(DataModelTestSuite.resultFilePath(imagePaths, DataModelTestSuite.TD));
+
+ assertEquals("Sequential test results (" + seqSortedOutputFile + ") differ with Top Dow (" + tdSortedOutputFile + ") .", DataModelTestSuite.comparecontent(seqSortedOutputFile, tdSortedOutputFile), true);
} catch (Exception ex) {
- fail("Couldn't open gold standard file.");
+ fail("SequentialTest error: " + ex.getMessage());
}
}
}
diff --git a/bindings/java/test/org/sleuthkit/datamodel/DataModelTestSuite.java b/bindings/java/test/org/sleuthkit/datamodel/DataModelTestSuite.java
index be12057cc1205d7b1535a39e0f106b4f698ebd58..ad294041251e46dc2e11880813eb903fa2208bdd 100644
--- a/bindings/java/test/org/sleuthkit/datamodel/DataModelTestSuite.java
+++ b/bindings/java/test/org/sleuthkit/datamodel/DataModelTestSuite.java
@@ -66,7 +66,7 @@ public class DataModelTestSuite {
*/
@BeforeClass
public static void setUpClass() throws Exception {
- java.io.File results = new java.io.File(getRsltPath());
+ java.io.File results = new java.io.File(getRsltDirPath());
for (java.io.File del : results.listFiles()) {
del.delete();
}
@@ -173,9 +173,7 @@ public boolean accept(java.io.File f) {
* @return path to put/find the standard at
*/
static String standardFilePath(List<String> imagePaths, String type) {
- String firstImage = getImgName(imagePaths.get(0));
- String standardPath = standardRootDirPath() + java.io.File.separator + firstImage + type + ".txt";
- return standardPath;
+ return buildPath(standardRootDirPath(), getImgName(imagePaths.get(0)), type, ".txt");
}
/**
@@ -241,13 +239,24 @@ public static String getImgName(String img) {
/**
- * Gets the location results are stored in.
+ * Gets the folder where results are stored in.
*
* @return
*/
- public static String getRsltPath() {
+ public static String getRsltDirPath() {
return System.getProperty(RSLT, "test" + java.io.File.separator + "output" + java.io.File.separator + "results");
}
+
+ /**
+ * Get the path for the output (result) file for a given image and test.
+ *
+ * @param imagePaths image being tested
+ * @param type Test type
+ * @return path to put the test output into
+ */
+ static String resultFilePath(List<String> imagePaths, String type) {
+ return buildPath(getRsltDirPath(), getImgName(imagePaths.get(0)), type, ".txt");
+ }
/**
* returns the path to the sort command
diff --git a/bindings/java/test/org/sleuthkit/datamodel/ImgTraverser.java b/bindings/java/test/org/sleuthkit/datamodel/ImgTraverser.java
index 7caf7eccff91380b84bf0e6e0775b5ac468f22aa..929f3aadc4baddef56ea10f70ebbf7503177ccce 100644
--- a/bindings/java/test/org/sleuthkit/datamodel/ImgTraverser.java
+++ b/bindings/java/test/org/sleuthkit/datamodel/ImgTraverser.java
@@ -21,6 +21,7 @@
import java.io.OutputStreamWriter;
import java.util.ArrayList;
import java.util.List;
+import static org.junit.Assert.*;
/**
* A basic implementation of traverser, has a standard test that allows for easy
@@ -40,12 +41,12 @@ public abstract class ImgTraverser{
*
* @return List of test results. Entry 0 is exceptions and 1 is for content. True if test passed.
*/
- public List<Boolean> basicTest() {
- String title = DataModelTestSuite.getImgName(imagePaths.get(0));
-
+ public List<Boolean> basicTest() {
// get paths to store output of test and exceptions
- java.io.File outputFolder = new java.io.File(DataModelTestSuite.getRsltPath());
- java.io.File outputFile = new java.io.File(DataModelTestSuite.buildPath(outputFolder.getAbsolutePath(), title, this.testName, ".txt"));
+ java.io.File outputFolder = new java.io.File(DataModelTestSuite.getRsltDirPath());
+ java.io.File outputFile = new java.io.File(DataModelTestSuite.resultFilePath(imagePaths, this.testName));
+ outputFile.delete();
+
outputFilePath = outputFile.getPath();
outputExceptionsPath = DataModelTestSuite.exceptionPath(outputFilePath);
goldFilePath = DataModelTestSuite.standardFilePath(imagePaths, this.testName);
@@ -53,6 +54,9 @@ public List<Boolean> basicTest() {
// Generate the sorted and unsorted output needed for the test
DataModelTestSuite.createOutput(outputFilePath, outputFolder.getAbsolutePath(), imagePaths, this);
+
+ // verify there is output
+ assertTrue ("Output file is zero sized (" + outputFilePath + ")", outputFile.length() > 0);
// compare the unsorted results
List<Boolean> ret = new ArrayList<Boolean>(2);
diff --git a/bindings/java/test/org/sleuthkit/datamodel/SequentialTraversal.java b/bindings/java/test/org/sleuthkit/datamodel/SequentialTraversal.java
index c8d870704a29c04d4e1c2a784fc8fa3c72f6e57b..ceeaebc1bc792d8e529ab1c9135212e14c925d8f 100644
--- a/bindings/java/test/org/sleuthkit/datamodel/SequentialTraversal.java
+++ b/bindings/java/test/org/sleuthkit/datamodel/SequentialTraversal.java
@@ -107,7 +107,6 @@ public OutputStreamWriter traverse(SleuthkitCase sk, String path) {
DataModelTestSuite.hashContent(c, reslt, outputExceptionsPath);
}
reslt.append("\n");
- x++;
}
} catch (TskCoreException ex) {
inp.add(ex);
diff --git a/tsk/fs/dcalc_lib.c b/tsk/fs/dcalc_lib.c
index 9f2e1b606a0947f0a84eb8fc48c0de94ce4d6e88..04477c9c1bdd9ee3fb4f70a6a85f3637e1e9ccba 100644
--- a/tsk/fs/dcalc_lib.c
+++ b/tsk/fs/dcalc_lib.c
@@ -200,17 +200,19 @@ tsk_fs_blkcalc(TSK_FS_INFO * fs, TSK_FS_BLKCALC_FLAG_ENUM a_lclflags,
if (a_lclflags == TSK_FS_BLKCALC_BLKLS) {
if (tsk_fs_block_walk(fs, fs->first_block, fs->last_block,
- (TSK_FS_BLOCK_WALK_FLAG_UNALLOC | TSK_FS_BLOCK_WALK_FLAG_META |
- TSK_FS_BLOCK_WALK_FLAG_CONT | TSK_FS_BLOCK_WALK_FLAG_AONLY),
- count_blkls_act, &data))
+ (TSK_FS_BLOCK_WALK_FLAG_UNALLOC |
+ TSK_FS_BLOCK_WALK_FLAG_META |
+ TSK_FS_BLOCK_WALK_FLAG_CONT |
+ TSK_FS_BLOCK_WALK_FLAG_AONLY), count_blkls_act, &data))
return -1;
}
else if (a_lclflags == TSK_FS_BLKCALC_DD) {
if (tsk_fs_block_walk(fs, fs->first_block, fs->last_block,
- (TSK_FS_BLOCK_WALK_FLAG_ALLOC | TSK_FS_BLOCK_WALK_FLAG_UNALLOC |
- TSK_FS_BLOCK_WALK_FLAG_META | TSK_FS_BLOCK_WALK_FLAG_CONT |
- TSK_FS_BLOCK_WALK_FLAG_AONLY),
- count_dd_act, &data))
+ (TSK_FS_BLOCK_WALK_FLAG_ALLOC |
+ TSK_FS_BLOCK_WALK_FLAG_UNALLOC |
+ TSK_FS_BLOCK_WALK_FLAG_META |
+ TSK_FS_BLOCK_WALK_FLAG_CONT |
+ TSK_FS_BLOCK_WALK_FLAG_AONLY), count_dd_act, &data))
return -1;
}
else if (a_lclflags == TSK_FS_BLKCALC_SLACK) {
diff --git a/tsk/fs/dstat_lib.c b/tsk/fs/dstat_lib.c
index 4f594ebc4045eb9676bf8decac449c2c9a08dc27..6e41b7614ed67b24fbe1ad980e954f47ee87d229 100644
--- a/tsk/fs/dstat_lib.c
+++ b/tsk/fs/dstat_lib.c
@@ -64,9 +64,9 @@ blkstat_act(const TSK_FS_BLOCK * fs_block, void *ptr)
uint8_t
tsk_fs_blkstat(TSK_FS_INFO * fs, TSK_DADDR_T addr)
{
- int flags =
+ int flags =
(TSK_FS_BLOCK_WALK_FLAG_UNALLOC | TSK_FS_BLOCK_WALK_FLAG_ALLOC |
- TSK_FS_BLOCK_WALK_FLAG_META | TSK_FS_BLOCK_WALK_FLAG_CONT |
- TSK_FS_BLOCK_WALK_FLAG_AONLY);
+ TSK_FS_BLOCK_WALK_FLAG_META | TSK_FS_BLOCK_WALK_FLAG_CONT |
+ TSK_FS_BLOCK_WALK_FLAG_AONLY);
return tsk_fs_block_walk(fs, addr, addr, flags, blkstat_act, NULL);
}
diff --git a/tsk/fs/ext2fs.c b/tsk/fs/ext2fs.c
index 9e578a5c7b6c06a8d69b1b0ede3a598b1f5487ad..d5aba52388dc9540f25197b2ad17e15cb47573a3 100644
--- a/tsk/fs/ext2fs.c
+++ b/tsk/fs/ext2fs.c
@@ -36,15 +36,15 @@
#ifdef Ext4_DBG
-static uint8_t debug_print_buf(unsigned char *buf, int len)
+static uint8_t
+debug_print_buf(unsigned char *buf, int len)
{
int i = 0;
- for(i=0; i<len; i++)
- {
- if(i%8 == 0)
+ for (i = 0; i < len; i++) {
+ if (i % 8 == 0)
printf("%08X:\t", i);
printf("0x%02X ", buf[i]);
- if((i+1)%8 == 0)
+ if ((i + 1) % 8 == 0)
printf("\n");
}
printf("\n");
@@ -61,17 +61,18 @@ static uint8_t debug_print_buf(unsigned char *buf, int len)
@param b the root
@return 1 if a is a power of b, otherwise 0
*/
-static uint8_t test_root(uint32_t a, uint32_t b)
+static uint8_t
+test_root(uint32_t a, uint32_t b)
{
- if (a == 0)
- return 1;
- while (1) {
- if (a == 1)
- return 1;
- if (a % b)
- return 0;
- a = a / b;
- }
+ if (a == 0)
+ return 1;
+ while (1) {
+ if (a == 1)
+ return 1;
+ if (a % b)
+ return 0;
+ a = a / b;
+ }
}
/** \internal
@@ -79,17 +80,17 @@ static uint8_t test_root(uint32_t a, uint32_t b)
Adapted from E2fsprogs sparse.c
@return 1 if block group has superblock, otherwise 0
*/
-static uint32_t ext2fs_bg_has_super(uint32_t feature_ro_compat, uint32_t group_block)
+static uint32_t
+ext2fs_bg_has_super(uint32_t feature_ro_compat, uint32_t group_block)
{
- if (!(feature_ro_compat &
- EXT2FS_FEATURE_RO_COMPAT_SPARSE_SUPER))
- return 1;
+ if (!(feature_ro_compat & EXT2FS_FEATURE_RO_COMPAT_SPARSE_SUPER))
+ return 1;
- if (test_root(group_block, 3) || (test_root(group_block, 5)) ||
- test_root(group_block, 7))
- return 1;
+ if (test_root(group_block, 3) || (test_root(group_block, 5)) ||
+ test_root(group_block, 7))
+ return 1;
- return 0;
+ return 0;
}
@@ -106,23 +107,24 @@ static uint32_t ext2fs_bg_has_super(uint32_t feature_ro_compat, uint32_t group_b
static uint8_t
ext2fs_group_load(EXT2FS_INFO * ext2fs, EXT2_GRPNUM_T grp_num)
{
- void *gd;
+ void *gd;
TSK_OFF_T offs;
ssize_t cnt;
TSK_FS_INFO *fs = (TSK_FS_INFO *) ext2fs;
- int gd_size = tsk_getu16(fs->endian,ext2fs->fs->s_desc_size);
- ext4fs_gd *ext4_gd = NULL;
+ int gd_size = tsk_getu16(fs->endian, ext2fs->fs->s_desc_size);
+ ext4fs_gd *ext4_gd = NULL;
- if(!gd_size){
- if(fs->ftype == TSK_FS_TYPE_EXT4 &&
- EXT2FS_HAS_INCOMPAT_FEATURE(fs,ext2fs->fs,EXT2FS_FEATURE_INCOMPAT_64BIT))
- {
- gd_size=sizeof(ext4fs_gd);
- }else{
- gd_size=sizeof(ext2fs_gd);
+ if (!gd_size) {
+ if (fs->ftype == TSK_FS_TYPE_EXT4 &&
+ EXT2FS_HAS_INCOMPAT_FEATURE(fs, ext2fs->fs,
+ EXT2FS_FEATURE_INCOMPAT_64BIT)) {
+ gd_size = sizeof(ext4fs_gd);
+ }
+ else {
+ gd_size = sizeof(ext2fs_gd);
}
}
-
+
/*
* Sanity check
@@ -137,12 +139,13 @@ ext2fs_group_load(EXT2FS_INFO * ext2fs, EXT2_GRPNUM_T grp_num)
}
if (ext2fs->grp_buf == NULL) {
- if(fs->ftype == TSK_FS_TYPE_EXT4){
- ext2fs->ext4_grp_buf = (ext4fs_gd *)tsk_malloc(gd_size);
- }else{
- ext2fs->grp_buf = (ext2fs_gd *)tsk_malloc(gd_size);
+ if (fs->ftype == TSK_FS_TYPE_EXT4) {
+ ext2fs->ext4_grp_buf = (ext4fs_gd *) tsk_malloc(gd_size);
}
- if(ext2fs->grp_buf == NULL && ext2fs->ext4_grp_buf == NULL){
+ else {
+ ext2fs->grp_buf = (ext2fs_gd *) tsk_malloc(gd_size);
+ }
+ if (ext2fs->grp_buf == NULL && ext2fs->ext4_grp_buf == NULL) {
return 1;
}
@@ -160,9 +163,9 @@ ext2fs_group_load(EXT2FS_INFO * ext2fs, EXT2_GRPNUM_T grp_num)
if (fs->ftype == TSK_FS_TYPE_EXT4)
gd = ext2fs->ext4_grp_buf;
cnt = tsk_fs_read(&ext2fs->fs_info, offs, (char *) gd, gd_size);
- /*DEBUG*/
+ /*DEBUG*/
#ifdef Ext4_DBG
- debug_print_buf((char *)ext2fs->ext4_grp_buf, gd_size);
+ debug_print_buf((char *) ext2fs->ext4_grp_buf, gd_size);
#endif
if (cnt != gd_size) {
if (cnt >= 0) {
@@ -174,32 +177,38 @@ ext2fs_group_load(EXT2FS_INFO * ext2fs, EXT2_GRPNUM_T grp_num)
return 1;
}
/* Perform a sanity check on the data to make sure offsets are in range */
- if (fs->ftype == TSK_FS_TYPE_EXT4){
- ext2fs->grp_buf =(ext2fs_gd*)ext2fs->ext4_grp_buf;
+ if (fs->ftype == TSK_FS_TYPE_EXT4) {
+ ext2fs->grp_buf = (ext2fs_gd *) ext2fs->ext4_grp_buf;
gd = ext2fs->ext4_grp_buf;
ext4_gd = ext2fs->ext4_grp_buf;
- if(EXT2FS_HAS_INCOMPAT_FEATURE(fs,ext2fs->fs,EXT2FS_FEATURE_INCOMPAT_64BIT)){
+ if (EXT2FS_HAS_INCOMPAT_FEATURE(fs, ext2fs->fs,
+ EXT2FS_FEATURE_INCOMPAT_64BIT)) {
#ifdef Ext4_DBG
- printf("DEBUG hi: %04X\n",*ext4_gd->bg_block_bitmap_hi);
- printf("DEBUG lo: %08X\n",*ext4_gd->bg_block_bitmap_lo);
+ printf("DEBUG hi: %04X\n", *ext4_gd->bg_block_bitmap_hi);
+ printf("DEBUG lo: %08X\n", *ext4_gd->bg_block_bitmap_lo);
printf("block_bitmap :%012lX\n",
- ext4_getu48(fs->endian,
- ext4_gd->bg_block_bitmap_hi,
- ext4_gd->bg_block_bitmap_lo));
+ ext4_getu48(fs->endian,
+ ext4_gd->bg_block_bitmap_hi,
+ ext4_gd->bg_block_bitmap_lo));
#endif
- }else{
+ }
+ else {
#ifdef Ext4_DBG
- printf("block_bitmap:%08lX\n",tsk_getu32(fs->endian,ext4_gd->bg_block_bitmap_lo));
- printf("stored checksum: %X\n",tsk_getu16(fs->endian,ext4_gd->bg_checksum));
+ printf("block_bitmap:%08lX\n", tsk_getu32(fs->endian,
+ ext4_gd->bg_block_bitmap_lo));
+ printf("stored checksum: %X\n", tsk_getu16(fs->endian,
+ ext4_gd->bg_checksum));
#endif
}
- }else{
- ext2fs_gd *ext2_gd = (ext2fs_gd *)gd;
+ }
+ else {
+ ext2fs_gd *ext2_gd = (ext2fs_gd *) gd;
if ((tsk_getu32(fs->endian,
ext2_gd->bg_block_bitmap) > fs->last_block) ||
(tsk_getu32(fs->endian,
ext2_gd->bg_inode_bitmap) > fs->last_block) ||
- (tsk_getu32(fs->endian, ext2_gd->bg_inode_table) > fs->last_block)) {
+ (tsk_getu32(fs->endian,
+ ext2_gd->bg_inode_table) > fs->last_block)) {
tsk_error_reset();
tsk_error_set_errno(TSK_ERR_FS_CORRUPT);
tsk_error_set_errstr("extXfs_group_load: Group %" PRI_EXT2GRP
@@ -211,10 +220,11 @@ ext2fs_group_load(EXT2FS_INFO * ext2fs, EXT2_GRPNUM_T grp_num)
ext2fs->grp_num = grp_num;
- if (fs->ftype == TSK_FS_TYPE_EXT4){
+ if (fs->ftype == TSK_FS_TYPE_EXT4) {
- }else{
- ext2fs_gd * ext2_gd = (ext2fs_gd *) gd;
+ }
+ else {
+ ext2fs_gd *ext2_gd = (ext2fs_gd *) gd;
if (tsk_verbose) {
TSK_FS_INFO *fs = (TSK_FS_INFO *) & ext2fs->fs_info;
tsk_fprintf(stderr,
@@ -241,58 +251,57 @@ ext2fs_group_load(EXT2FS_INFO * ext2fs, EXT2_GRPNUM_T grp_num)
//Temporarily removing CRC16 code until non-GPL version implemented
//static uint16_t
//ext4_group_desc_csum(ext2fs_sb *ext4_sb, uint32_t block_group,
-// struct ext4fs_gd *gdp)
+// struct ext4fs_gd *gdp)
//{
-// uint16_t crc = 0;
-// if (*ext4_sb->s_feature_ro_compat & EXT2FS_FEATURE_RO_COMPAT_GDT_CSUM)
-// {
-// int offset = offsetof(struct ext4fs_gd, bg_checksum);
-// uint32_t le_group = tsk_getu32(TSK_LIT_ENDIAN, &block_group);
-// crc = crc16(~0, ext4_sb->s_uuid, sizeof(ext4_sb->s_uuid));
-// crc = crc16(crc, (uint8_t *)&le_group, sizeof(le_group));
-// crc = crc16(crc, (uint8_t *)gdp, offset);
-// offset += sizeof(gdp->bg_checksum); /* skip checksum */
-// /* for checksum of struct ext4_group_desc do the rest...*/
-// if ((*ext4_sb->s_feature_incompat &
-// EXT2FS_FEATURE_INCOMPAT_64BIT) &&
-// offset < *ext4_sb->s_desc_size)
+// uint16_t crc = 0;
+// if (*ext4_sb->s_feature_ro_compat & EXT2FS_FEATURE_RO_COMPAT_GDT_CSUM)
+// {
+// int offset = offsetof(struct ext4fs_gd, bg_checksum);
+// uint32_t le_group = tsk_getu32(TSK_LIT_ENDIAN, &block_group);
+// crc = crc16(~0, ext4_sb->s_uuid, sizeof(ext4_sb->s_uuid));
+// crc = crc16(crc, (uint8_t *)&le_group, sizeof(le_group));
+// crc = crc16(crc, (uint8_t *)gdp, offset);
+// offset += sizeof(gdp->bg_checksum); /* skip checksum */
+// /* for checksum of struct ext4_group_desc do the rest...*/
+// if ((*ext4_sb->s_feature_incompat &
+// EXT2FS_FEATURE_INCOMPAT_64BIT) &&
+// offset < *ext4_sb->s_desc_size)
// {
-// crc = crc16(crc, (uint8_t *)gdp + offset, *ext4_sb->s_desc_size - offset);
+// crc = crc16(crc, (uint8_t *)gdp + offset, *ext4_sb->s_desc_size - offset);
// }
-// }
+// }
//
-// return crc;
+// return crc;
//}
static cm_t CRC16_CTX;
static uint16_t
-ext4_group_desc_csum(ext2fs_sb *ext4_sb, uint32_t block_group,
- struct ext4fs_gd *gdp)
+ext4_group_desc_csum(ext2fs_sb * ext4_sb, uint32_t block_group,
+ struct ext4fs_gd *gdp)
{
-CRC16_CTX.cm_width = 16;
-CRC16_CTX.cm_poly = 0x8005L;
-CRC16_CTX.cm_init = 0xFFFFL;
-CRC16_CTX.cm_refin = TRUE;
-CRC16_CTX.cm_refot = TRUE;
-CRC16_CTX.cm_xorot = 0x0000L;
+ CRC16_CTX.cm_width = 16;
+ CRC16_CTX.cm_poly = 0x8005L;
+ CRC16_CTX.cm_init = 0xFFFFL;
+ CRC16_CTX.cm_refin = TRUE;
+ CRC16_CTX.cm_refot = TRUE;
+ CRC16_CTX.cm_xorot = 0x0000L;
cm_ini(&CRC16_CTX);
- if (*ext4_sb->s_feature_ro_compat & EXT2FS_FEATURE_RO_COMPAT_GDT_CSUM)
- {
- int offset = offsetof(struct ext4fs_gd, bg_checksum);
- uint32_t le_group = tsk_getu32(TSK_LIT_ENDIAN, &block_group);
- crc16(&CRC16_CTX, ext4_sb->s_uuid, sizeof(ext4_sb->s_uuid));
- crc16(&CRC16_CTX, (uint8_t *)&le_group, sizeof(le_group));
- crc16(&CRC16_CTX, (uint8_t *)gdp, offset);
- offset += sizeof(gdp->bg_checksum); /* skip checksum */
- /* for checksum of struct ext4_group_desc do the rest...*/
- if ((*ext4_sb->s_feature_incompat &
- EXT2FS_FEATURE_INCOMPAT_64BIT) &&
- offset < *ext4_sb->s_desc_size)
- {
- crc16(&CRC16_CTX, (uint8_t *)gdp + offset, *ext4_sb->s_desc_size - offset);
- }
- }
+ if (*ext4_sb->s_feature_ro_compat & EXT2FS_FEATURE_RO_COMPAT_GDT_CSUM) {
+ int offset = offsetof(struct ext4fs_gd, bg_checksum);
+ uint32_t le_group = tsk_getu32(TSK_LIT_ENDIAN, &block_group);
+ crc16(&CRC16_CTX, ext4_sb->s_uuid, sizeof(ext4_sb->s_uuid));
+ crc16(&CRC16_CTX, (uint8_t *) & le_group, sizeof(le_group));
+ crc16(&CRC16_CTX, (uint8_t *) gdp, offset);
+ offset += sizeof(gdp->bg_checksum); /* skip checksum */
+ /* for checksum of struct ext4_group_desc do the rest... */
+ if ((*ext4_sb->s_feature_incompat &
+ EXT2FS_FEATURE_INCOMPAT_64BIT) &&
+ offset < *ext4_sb->s_desc_size) {
+ crc16(&CRC16_CTX, (uint8_t *) gdp + offset,
+ *ext4_sb->s_desc_size - offset);
+ }
+ }
return cm_crc(&CRC16_CTX);
}
@@ -439,43 +448,46 @@ ext2fs_imap_load(EXT2FS_INFO * ext2fs, EXT2_GRPNUM_T grp_num)
/*
* Look up the inode allocation bitmap.
*/
- if(EXT2FS_HAS_INCOMPAT_FEATURE(fs, ext2fs->fs, EXT2FS_FEATURE_INCOMPAT_64BIT))
- {
- if( ext4_getu64(fs->endian, ext2fs->ext4_grp_buf->bg_block_bitmap_hi, ext2fs->ext4_grp_buf->bg_block_bitmap_lo)
- > fs->last_block)
- {
+ if (EXT2FS_HAS_INCOMPAT_FEATURE(fs, ext2fs->fs,
+ EXT2FS_FEATURE_INCOMPAT_64BIT)) {
+ if (ext4_getu64(fs->endian,
+ ext2fs->ext4_grp_buf->bg_block_bitmap_hi,
+ ext2fs->ext4_grp_buf->bg_block_bitmap_lo)
+ > fs->last_block) {
tsk_error_reset();
tsk_error_set_errno(TSK_ERR_FS_BLK_NUM);
tsk_error_set_errstr
- ("ext2fs_imap_load: Block too large for image: %" PRIu64 "",
- ext4_getu64(fs->endian, ext2fs->ext4_grp_buf->bg_block_bitmap_hi, ext2fs->ext4_grp_buf->bg_block_bitmap_lo));
- }
+ ("ext2fs_imap_load: Block too large for image: %" PRIu64
+ "", ext4_getu64(fs->endian,
+ ext2fs->ext4_grp_buf->bg_block_bitmap_hi,
+ ext2fs->ext4_grp_buf->bg_block_bitmap_lo));
+ }
cnt = tsk_fs_read(fs,
(TSK_DADDR_T) ext4_getu64(fs->endian,
- ext2fs->ext4_grp_buf->bg_inode_bitmap_hi, ext2fs->ext4_grp_buf->bg_block_bitmap_lo) * fs->block_size,
+ ext2fs->ext4_grp_buf->bg_inode_bitmap_hi,
+ ext2fs->ext4_grp_buf->bg_block_bitmap_lo) * fs->block_size,
(char *) ext2fs->imap_buf, ext2fs->fs_info.block_size);
if (cnt != ext2fs->fs_info.block_size) {
- if (cnt >= 0) {
- tsk_error_reset();
- tsk_error_set_errno(TSK_ERR_FS_READ);
- }
- tsk_error_set_errstr2("ext2fs_imap_load: Inode bitmap %"
+ if (cnt >= 0) {
+ tsk_error_reset();
+ tsk_error_set_errno(TSK_ERR_FS_READ);
+ }
+ tsk_error_set_errstr2("ext2fs_imap_load: Inode bitmap %"
PRI_EXT2GRP " at %" PRIu32, grp_num, tsk_getu32(fs->endian,
ext2fs->grp_buf->bg_inode_bitmap));
}
}
- else
- {
+ else {
if (tsk_getu32(fs->endian,
- ext2fs->grp_buf->bg_inode_bitmap) > fs->last_block)
- {
+ ext2fs->grp_buf->bg_inode_bitmap) > fs->last_block) {
tsk_error_reset();
tsk_error_set_errno(TSK_ERR_FS_BLK_NUM);
tsk_error_set_errstr
- ("ext2fs_imap_load: Block too large for image: %" PRIu32 "",
- tsk_getu32(fs->endian, ext2fs->grp_buf->bg_inode_bitmap));
+ ("ext2fs_imap_load: Block too large for image: %" PRIu32
+ "", tsk_getu32(fs->endian,
+ ext2fs->grp_buf->bg_inode_bitmap));
}
cnt = tsk_fs_read(fs,
@@ -560,21 +572,21 @@ ext2fs_dinode_load(EXT2FS_INFO * ext2fs, TSK_INUM_T dino_inum,
rel_inum =
(dino_inum - 1) - tsk_getu32(fs->endian,
ext2fs->fs->s_inodes_per_group) * grp_num;
- if(EXT2FS_HAS_INCOMPAT_FEATURE(fs, ext2fs->fs, EXT2FS_FEATURE_INCOMPAT_64BIT) &&
- (tsk_getu16(fs->endian,ext2fs->fs->s_desc_size) >= 64))
- {
+ if (EXT2FS_HAS_INCOMPAT_FEATURE(fs, ext2fs->fs,
+ EXT2FS_FEATURE_INCOMPAT_64BIT)
+ && (tsk_getu16(fs->endian, ext2fs->fs->s_desc_size) >= 64)) {
#ifdef Ext4_DBG
- printf("DEBUG: d_inode_load 64bit gd_size=%d\n", tsk_getu16(fs->endian,ext2fs->fs->s_desc_size));
-#endif
+ printf("DEBUG: d_inode_load 64bit gd_size=%d\n",
+ tsk_getu16(fs->endian, ext2fs->fs->s_desc_size));
+#endif
addr =
- (TSK_OFF_T) ext4_getu64(fs->endian,
- ext2fs->ext4_grp_buf->bg_inode_table_hi,
- ext2fs->ext4_grp_buf->bg_inode_table_lo)
- * (TSK_OFF_T) fs->block_size +
- rel_inum * (TSK_OFF_T) ext2fs->inode_size;
+ (TSK_OFF_T) ext4_getu64(fs->endian,
+ ext2fs->ext4_grp_buf->bg_inode_table_hi,
+ ext2fs->ext4_grp_buf->bg_inode_table_lo)
+ * (TSK_OFF_T) fs->block_size +
+ rel_inum * (TSK_OFF_T) ext2fs->inode_size;
}
- else
- {
+ else {
addr =
(TSK_OFF_T) tsk_getu32(fs->endian,
ext2fs->grp_buf->bg_inode_table) * (TSK_OFF_T) fs->block_size +
@@ -736,14 +748,18 @@ ext2fs_dinode_copy(EXT2FS_INFO * ext2fs, TSK_FS_META * fs_meta,
fs_meta->atime = tsk_getu32(fs->endian, dino_buf->i_atime);
fs_meta->ctime = tsk_getu32(fs->endian, dino_buf->i_ctime);
fs_meta->time2.ext2.dtime = tsk_getu32(fs->endian, dino_buf->i_dtime);
- if(fs->ftype == TSK_FS_TYPE_EXT4){
- fs_meta->mtime_nano = tsk_getu32(fs->endian, dino_buf->i_mtime_extra) >> 2;
- fs_meta->atime_nano = tsk_getu32(fs->endian, dino_buf->i_atime_extra) >> 2;
- fs_meta->ctime_nano = tsk_getu32(fs->endian, dino_buf->i_ctime_extra) >> 2;
- fs_meta->crtime=tsk_getu32(fs->endian,dino_buf->i_crtime);
- fs_meta->crtime_nano = tsk_getu32(fs->endian, dino_buf->i_crtime_extra) >> 2;
- }else
- {
+ if (fs->ftype == TSK_FS_TYPE_EXT4) {
+ fs_meta->mtime_nano =
+ tsk_getu32(fs->endian, dino_buf->i_mtime_extra) >> 2;
+ fs_meta->atime_nano =
+ tsk_getu32(fs->endian, dino_buf->i_atime_extra) >> 2;
+ fs_meta->ctime_nano =
+ tsk_getu32(fs->endian, dino_buf->i_ctime_extra) >> 2;
+ fs_meta->crtime = tsk_getu32(fs->endian, dino_buf->i_crtime);
+ fs_meta->crtime_nano =
+ tsk_getu32(fs->endian, dino_buf->i_crtime_extra) >> 2;
+ }
+ else {
fs_meta->mtime_nano = fs_meta->atime_nano = fs_meta->ctime_nano =
fs_meta->crtime = 0;
}
@@ -767,7 +783,7 @@ ext2fs_dinode_copy(EXT2FS_INFO * ext2fs, TSK_FS_META * fs_meta,
uint32_t *addr_ptr;
fs_meta->content_type = TSK_FS_META_CONTENT_TYPE_EXT4_EXTENTS;
/* NOTE TSK_DADDR_T != uint32_t, so lets make sure we use uint32_t */
- addr_ptr = (uint32_t *)fs_meta->content_ptr;
+ addr_ptr = (uint32_t *) fs_meta->content_ptr;
for (i = 0; i < EXT2FS_NDADDR + EXT2FS_NIADDR; i++) {
addr_ptr[i] = tsk_gets32(fs->endian, dino_buf->i_block[i]);;
}
@@ -821,7 +837,8 @@ ext2fs_dinode_copy(EXT2FS_INFO * ext2fs, TSK_FS_META * fs_meta,
/* we only need to do the direct blocks due to the limit
* on path length */
- for (i = 0; i < EXT2FS_NDADDR && count < fs_meta->size; i++) {
+ for (i = 0; i < EXT2FS_NDADDR && count < fs_meta->size;
+ i++) {
ssize_t cnt;
int read_count =
@@ -937,9 +954,10 @@ ext2fs_inode_lookup(TSK_FS_INFO * fs, TSK_FS_FILE * a_fs_file,
return 0;
}
- size = ext2fs->inode_size > sizeof(ext2fs_inode) ? ext2fs->inode_size : sizeof(ext2fs_inode);
- if ((dino_buf =
- (ext2fs_inode *) tsk_malloc(size)) == NULL) {
+ size =
+ ext2fs->inode_size >
+ sizeof(ext2fs_inode) ? ext2fs->inode_size : sizeof(ext2fs_inode);
+ if ((dino_buf = (ext2fs_inode *) tsk_malloc(size)) == NULL) {
return 1;
}
@@ -1062,9 +1080,10 @@ ext2fs_inode_walk(TSK_FS_INFO * fs, TSK_INUM_T start_inum,
/*
* Iterate.
*/
- size = ext2fs->inode_size > sizeof(ext2fs_inode) ? ext2fs->inode_size : sizeof(ext2fs_inode);
- if ((dino_buf =
- (ext2fs_inode *) tsk_malloc(size)) == NULL) {
+ size =
+ ext2fs->inode_size >
+ sizeof(ext2fs_inode) ? ext2fs->inode_size : sizeof(ext2fs_inode);
+ if ((dino_buf = (ext2fs_inode *) tsk_malloc(size)) == NULL) {
return 1;
}
@@ -1348,7 +1367,7 @@ ext2fs_block_walk(TSK_FS_INFO * a_fs, TSK_DADDR_T a_start_blk,
else if ((myflags & TSK_FS_BLOCK_FLAG_UNALLOC)
&& (!(a_flags & TSK_FS_BLOCK_WALK_FLAG_UNALLOC)))
continue;
-
+
if (a_flags & TSK_FS_BLOCK_WALK_FLAG_AONLY)
myflags |= TSK_FS_BLOCK_FLAG_AONLY;
@@ -1391,7 +1410,7 @@ ext2fs_fscheck(TSK_FS_INFO * fs, FILE * hFile)
*/
static TSK_OFF_T
ext2fs_make_data_run_extent(TSK_FS_INFO * fs_info, TSK_FS_ATTR * fs_attr,
- ext2fs_extent *extent)
+ ext2fs_extent * extent)
{
TSK_FS_ATTR_RUN *data_run;
data_run = tsk_fs_attr_run_alloc();
@@ -1400,7 +1419,10 @@ ext2fs_make_data_run_extent(TSK_FS_INFO * fs_info, TSK_FS_ATTR * fs_attr,
}
data_run->offset = tsk_getu32(fs_info->endian, extent->ee_block);
- data_run->addr = (((uint32_t)tsk_getu16(fs_info->endian, extent->ee_start_hi)) << 16) | tsk_getu32(fs_info->endian, extent->ee_start_lo);
+ data_run->addr =
+ (((uint32_t) tsk_getu16(fs_info->endian,
+ extent->ee_start_hi)) << 16) | tsk_getu32(fs_info->endian,
+ extent->ee_start_lo);
data_run->len = tsk_getu16(fs_info->endian, extent->ee_len);
// save the run
@@ -1418,36 +1440,40 @@ ext2fs_make_data_run_extent(TSK_FS_INFO * fs_info, TSK_FS_ATTR * fs_attr,
* @return 0 on success, 1 on error.
*/
static TSK_OFF_T
-ext2fs_make_data_run_extent_index(TSK_FS_INFO *fs_info, TSK_FS_ATTR *fs_attr,
- TSK_FS_ATTR *fs_attr_extent, TSK_DADDR_T idx_block)
+ext2fs_make_data_run_extent_index(TSK_FS_INFO * fs_info,
+ TSK_FS_ATTR * fs_attr, TSK_FS_ATTR * fs_attr_extent,
+ TSK_DADDR_T idx_block)
{
ext2fs_extent_header *header;
- TSK_FS_ATTR_RUN* data_run;
+ TSK_FS_ATTR_RUN *data_run;
uint8_t *buf;
ssize_t cnt;
unsigned int i;
/* first, read the block specified by the parameter */
int fs_blocksize = fs_info->block_size;
- if ((buf = (uint8_t *)tsk_malloc(fs_blocksize)) == NULL) {
+ if ((buf = (uint8_t *) tsk_malloc(fs_blocksize)) == NULL) {
return 1;
}
- cnt = tsk_fs_read_block(fs_info, idx_block, (char *)buf, fs_blocksize);
+ cnt =
+ tsk_fs_read_block(fs_info, idx_block, (char *) buf, fs_blocksize);
if (cnt != fs_blocksize) {
if (cnt >= 0) {
tsk_error_reset();
tsk_error_set_errno(TSK_ERR_FS_READ);
}
- tsk_error_set_errstr("ext2fs_make_data_run_extent_index: Block %" PRIuDADDR, idx_block);
+ tsk_error_set_errstr("ext2fs_make_data_run_extent_index: Block %"
+ PRIuDADDR, idx_block);
return 1;
}
- header = (ext2fs_extent_header *)buf;
+ header = (ext2fs_extent_header *) buf;
/* add it to the extent attribute */
if (tsk_getu16(fs_info->endian, header->eh_magic) != 0xF30A) {
tsk_error_set_errno(TSK_ERR_FS_INODE_COR);
- tsk_error_set_errstr("ext2fs_make_data_run_extent_index: extent header magic valid incorrect!");
+ tsk_error_set_errstr
+ ("ext2fs_make_data_run_extent_index: extent header magic valid incorrect!");
return 1;
}
@@ -1464,8 +1490,9 @@ ext2fs_make_data_run_extent_index(TSK_FS_INFO *fs_info, TSK_FS_ATTR *fs_attr,
/* process leaf nodes */
if (tsk_getu16(fs_info->endian, header->eh_depth) == 0) {
- ext2fs_extent *extents = (ext2fs_extent *)(header + 1);
- for (i = 0; i < tsk_getu16(fs_info->endian, header->eh_entries); i++) {
+ ext2fs_extent *extents = (ext2fs_extent *) (header + 1);
+ for (i = 0; i < tsk_getu16(fs_info->endian, header->eh_entries);
+ i++) {
ext2fs_extent extent = extents[i];
if (ext2fs_make_data_run_extent(fs_info, fs_attr, &extent)) {
return 1;
@@ -1474,11 +1501,16 @@ ext2fs_make_data_run_extent_index(TSK_FS_INFO *fs_info, TSK_FS_ATTR *fs_attr,
}
/* recurse on interior nodes */
else {
- ext2fs_extent_idx *indices = (ext2fs_extent_idx *)(header + 1);
- for (i = 0; i < tsk_getu16(fs_info->endian, header->eh_entries); i++) {
+ ext2fs_extent_idx *indices = (ext2fs_extent_idx *) (header + 1);
+ for (i = 0; i < tsk_getu16(fs_info->endian, header->eh_entries);
+ i++) {
ext2fs_extent_idx *index = &indices[i];
- TSK_DADDR_T child_block = (((uint32_t)tsk_getu16(fs_info->endian, index->ei_leaf_hi)) << 16) | tsk_getu32(fs_info->endian, index->ei_leaf_lo);
- if (ext2fs_make_data_run_extent_index(fs_info, fs_attr, fs_attr_extent, child_block)) {
+ TSK_DADDR_T child_block =
+ (((uint32_t) tsk_getu16(fs_info->endian,
+ index->ei_leaf_hi)) << 16) | tsk_getu32(fs_info->
+ endian, index->ei_leaf_lo);
+ if (ext2fs_make_data_run_extent_index(fs_info, fs_attr,
+ fs_attr_extent, child_block)) {
return 1;
}
}
@@ -1495,8 +1527,9 @@ ext2fs_make_data_run_extent_index(TSK_FS_INFO *fs_info, TSK_FS_ATTR *fs_attr,
* @return the number of extent blocks, or -1 on error.
*/
static int32_t
-ext2fs_extent_tree_index_count(TSK_FS_INFO *fs_info, TSK_FS_META *fs_meta,
- ext2fs_extent_header *header) {
+ext2fs_extent_tree_index_count(TSK_FS_INFO * fs_info,
+ TSK_FS_META * fs_meta, ext2fs_extent_header * header)
+{
int fs_blocksize = fs_info->block_size;
ext2fs_extent_idx *indices;
int count = 0;
@@ -1505,23 +1538,28 @@ ext2fs_extent_tree_index_count(TSK_FS_INFO *fs_info, TSK_FS_META *fs_meta,
if (tsk_getu16(fs_info->endian, header->eh_magic) != 0xF30A) {
tsk_error_set_errno(TSK_ERR_FS_INODE_COR);
- tsk_error_set_errstr("ext2fs_load_attrs: extent header magic valid incorrect!");
+ tsk_error_set_errstr
+ ("ext2fs_load_attrs: extent header magic valid incorrect!");
return -1;
}
if (tsk_getu16(fs_info->endian, header->eh_depth) == 0) {
- return 0;
+ return 0;
}
- if ((buf = (uint8_t *)tsk_malloc(fs_blocksize)) == NULL) {
+ if ((buf = (uint8_t *) tsk_malloc(fs_blocksize)) == NULL) {
return -1;
}
- indices = (ext2fs_extent_idx *)(header + 1);
+ indices = (ext2fs_extent_idx *) (header + 1);
for (i = 0; i < tsk_getu16(fs_info->endian, header->eh_entries); i++) {
ext2fs_extent_idx *index = &indices[i];
- TSK_DADDR_T block = (((uint32_t)tsk_getu16(fs_info->endian, index->ei_leaf_hi)) << 16) | tsk_getu32(fs_info->endian, index->ei_leaf_lo);
- ssize_t cnt = tsk_fs_read_block(fs_info, block, (char *)buf, fs_blocksize);
+ TSK_DADDR_T block =
+ (((uint32_t) tsk_getu16(fs_info->endian,
+ index->ei_leaf_hi)) << 16) | tsk_getu32(fs_info->
+ endian, index->ei_leaf_lo);
+ ssize_t cnt =
+ tsk_fs_read_block(fs_info, block, (char *) buf, fs_blocksize);
int ret;
if (cnt != fs_blocksize) {
@@ -1529,11 +1567,14 @@ ext2fs_extent_tree_index_count(TSK_FS_INFO *fs_info, TSK_FS_META *fs_meta,
tsk_error_reset();
tsk_error_set_errno(TSK_ERR_FS_READ);
}
- tsk_error_set_errstr2("ext2fs_extent_tree_index_count: Block %" PRIuDADDR, block);
+ tsk_error_set_errstr2("ext2fs_extent_tree_index_count: Block %"
+ PRIuDADDR, block);
return -1;
}
- if ((ret = ext2fs_extent_tree_index_count(fs_info, fs_meta, (ext2fs_extent_header *)buf)) < 0) {
+ if ((ret =
+ ext2fs_extent_tree_index_count(fs_info, fs_meta,
+ (ext2fs_extent_header *) buf)) < 0) {
return -1;
}
count += ret;
@@ -1559,17 +1600,20 @@ ext2fs_load_attrs(TSK_FS_FILE * fs_file)
TSK_OFF_T length = 0;
TSK_FS_ATTR *fs_attr;
int i;
- ext2fs_extent *extents = NULL;
- ext2fs_extent_idx *indices = NULL;
+ ext2fs_extent *extents = NULL;
+ ext2fs_extent_idx *indices = NULL;
if (fs_meta->content_type == TSK_FS_META_CONTENT_TYPE_EXT4_EXTENTS) {
- ext2fs_extent_header *header = (ext2fs_extent_header *)fs_meta->content_ptr;
- uint16_t num_entries = tsk_getu16(fs_info->endian, header->eh_entries);
+ ext2fs_extent_header *header =
+ (ext2fs_extent_header *) fs_meta->content_ptr;
+ uint16_t num_entries =
+ tsk_getu16(fs_info->endian, header->eh_entries);
uint16_t depth = tsk_getu16(fs_info->endian, header->eh_depth);
if (tsk_getu16(fs_info->endian, header->eh_magic) != 0xF30A) {
tsk_error_set_errno(TSK_ERR_FS_INODE_COR);
- tsk_error_set_errstr("ext2fs_load_attrs: extent header magic valid incorrect!");
+ tsk_error_set_errstr
+ ("ext2fs_load_attrs: extent header magic valid incorrect!");
return TSK_COR;
}
@@ -1593,8 +1637,8 @@ ext2fs_load_attrs(TSK_FS_FILE * fs_file)
if (TSK_FS_TYPE_ISEXT(fs_info->ftype) == 0) {
tsk_error_set_errno(TSK_ERR_FS_INODE_COR);
- tsk_error_set_errstr(
- "ext2fs_load_attr: Called with non-ExtX file system: %x",
+ tsk_error_set_errstr
+ ("ext2fs_load_attr: Called with non-ExtX file system: %x",
fs_info->ftype);
return 1;
}
@@ -1613,14 +1657,18 @@ ext2fs_load_attrs(TSK_FS_FILE * fs_file)
return 1;
}
- if (depth == 0) { /* leaf node */
- if (num_entries > (fs_info->block_size - sizeof(ext2fs_extent_header)) / sizeof(ext2fs_extent)) {
+ if (depth == 0) { /* leaf node */
+ if (num_entries >
+ (fs_info->block_size -
+ sizeof(ext2fs_extent_header)) /
+ sizeof(ext2fs_extent)) {
tsk_error_set_errno(TSK_ERR_FS_INODE_COR);
- tsk_error_set_errstr("ext2fs_load_attr: Inode reports too many extents");
+ tsk_error_set_errstr
+ ("ext2fs_load_attr: Inode reports too many extents");
return 1;
}
- extents = (ext2fs_extent *)(header + 1);
+ extents = (ext2fs_extent *) (header + 1);
for (i = 0; i < num_entries; i++) {
ext2fs_extent extent = extents[i];
if (ext2fs_make_data_run_extent(fs_info, fs_attr, &extent)) {
@@ -1628,13 +1676,17 @@ ext2fs_load_attrs(TSK_FS_FILE * fs_file)
}
}
}
- else { /* interior node */
+ else { /* interior node */
TSK_FS_ATTR *fs_attr_extent;
int32_t extent_index_size;
- if (num_entries > (fs_info->block_size - sizeof(ext2fs_extent_header)) / sizeof(ext2fs_extent_idx)) {
+ if (num_entries >
+ (fs_info->block_size -
+ sizeof(ext2fs_extent_header)) /
+ sizeof(ext2fs_extent_idx)) {
tsk_error_set_errno(TSK_ERR_FS_INODE_COR);
- tsk_error_set_errstr("ext2fs_load_attr: Inode reports too many extent indices");
+ tsk_error_set_errstr
+ ("ext2fs_load_attr: Inode reports too many extent indices");
return 1;
}
@@ -1644,7 +1696,8 @@ ext2fs_load_attrs(TSK_FS_FILE * fs_file)
return 1;
}
- extent_index_size = ext2fs_extent_tree_index_count(fs_info, fs_meta, header);
+ extent_index_size =
+ ext2fs_extent_tree_index_count(fs_info, fs_meta, header);
if (extent_index_size < 0) {
return 1;
}
@@ -1653,16 +1706,20 @@ ext2fs_load_attrs(TSK_FS_FILE * fs_file)
TSK_FS_ATTR_TYPE_UNIX_EXTENT, TSK_FS_ATTR_ID_DEFAULT,
fs_info->block_size * extent_index_size,
fs_info->block_size * extent_index_size,
- fs_info->block_size * extent_index_size,
- 0, 0)) {
+ fs_info->block_size * extent_index_size, 0, 0)) {
return 1;
}
- indices= (ext2fs_extent_idx *)(header + 1);
+ indices = (ext2fs_extent_idx *) (header + 1);
for (i = 0; i < num_entries; i++) {
ext2fs_extent_idx *index = &indices[i];
- TSK_DADDR_T child_block = (((uint32_t)tsk_getu16(fs_info->endian, index->ei_leaf_hi)) << 16) | tsk_getu32(fs_info->endian, index->ei_leaf_lo);
- if (ext2fs_make_data_run_extent_index(fs_info, fs_attr, fs_attr_extent, child_block)) {
+ TSK_DADDR_T child_block =
+ (((uint32_t) tsk_getu16(fs_info->endian,
+ index->
+ ei_leaf_hi)) << 16) | tsk_getu32(fs_info->
+ endian, index->ei_leaf_lo);
+ if (ext2fs_make_data_run_extent_index(fs_info, fs_attr,
+ fs_attr_extent, child_block)) {
return 1;
}
}
@@ -1678,7 +1735,8 @@ ext2fs_load_attrs(TSK_FS_FILE * fs_file)
static void
-ext4_fsstat_datablock_helper(TSK_FS_INFO *fs, FILE *hFile, unsigned int i, TSK_DADDR_T cg_base, int gd_size)
+ext4_fsstat_datablock_helper(TSK_FS_INFO * fs, FILE * hFile,
+ unsigned int i, TSK_DADDR_T cg_base, int gd_size)
{
EXT2FS_INFO *ext2fs = (EXT2FS_INFO *) fs;
ext2fs_sb *sb = ext2fs->fs;
@@ -1687,124 +1745,131 @@ ext4_fsstat_datablock_helper(TSK_FS_INFO *fs, FILE *hFile, unsigned int i, TSK_D
unsigned int num_flex_bg, curr_flex_bg;
uint64_t last_block;
ext4fs_gd *ext4_gd = ext2fs->ext4_grp_buf;
- uint64_t db_offset = 0;
- unsigned int num_groups = 0, left_over = 0;
+ uint64_t db_offset = 0;
+ unsigned int num_groups = 0, left_over = 0;
-#ifdef Ext4_DBG
+#ifdef Ext4_DBG
printf("\nDEBUG 64bit:%d, gd_size %d, combined %d\n",
- EXT2FS_HAS_INCOMPAT_FEATURE(fs, sb, EXT2FS_FEATURE_INCOMPAT_64BIT),
- gd_size >= 64,
- EXT2FS_HAS_INCOMPAT_FEATURE(fs, sb, EXT2FS_FEATURE_INCOMPAT_64BIT) && gd_size >= 64);
-#endif
+ EXT2FS_HAS_INCOMPAT_FEATURE(fs, sb, EXT2FS_FEATURE_INCOMPAT_64BIT),
+ gd_size >= 64,
+ EXT2FS_HAS_INCOMPAT_FEATURE(fs, sb, EXT2FS_FEATURE_INCOMPAT_64BIT)
+ && gd_size >= 64);
+#endif
/* number of blocks the inodes consume */
ibpg =
(tsk_getu32(fs->endian,
sb->s_inodes_per_group) * ext2fs->inode_size + fs->block_size -
1) / fs->block_size;
/* number of blocks group descriptors consume */
- gd_blocks = (gd_size * ext2fs->groups_count + fs->block_size-1)/ fs->block_size;
- num_flex_bg = (ext2fs->groups_count/gpfbg);
- if(ext2fs->groups_count % gpfbg)
- num_flex_bg ++;
- curr_flex_bg = i/gpfbg;
-
- last_block = cg_base + tsk_getu32(fs->endian,sb->s_blocks_per_group) - 1;
- if (last_block > fs->last_block)
- {
+ gd_blocks =
+ (gd_size * ext2fs->groups_count + fs->block_size -
+ 1) / fs->block_size;
+ num_flex_bg = (ext2fs->groups_count / gpfbg);
+ if (ext2fs->groups_count % gpfbg)
+ num_flex_bg++;
+ curr_flex_bg = i / gpfbg;
+
+ last_block =
+ cg_base + tsk_getu32(fs->endian, sb->s_blocks_per_group) - 1;
+ if (last_block > fs->last_block) {
last_block = fs->last_block;
}
//DEBUG printf("ibpg %d cur_flex: %d, flex_bgs: %d : %d, %d",ibpg, i/gpfbg, num_flex_bg, ext2fs->groups_count/gpfbg, ext2fs->groups_count%gpfbg);
#ifdef Ext4_DBG
- printf("\nDEBUG: Flex BG PROCESSING cg_base: %"PRIuDADDR", gpfbg: %d, ibpg: %d \n", cg_base, gpfbg, ibpg);
+ printf("\nDEBUG: Flex BG PROCESSING cg_base: %" PRIuDADDR
+ ", gpfbg: %d, ibpg: %d \n", cg_base, gpfbg, ibpg);
#endif
/*If this is the 1st bg in a flex bg then it contains the bitmaps and inode tables */
//if(ext2fs_bg_has_super(tsk_getu32(fs->endian,sb->s_feature_ro_compat),i))
//{
- if (i%gpfbg == 0)
- {
- if (curr_flex_bg == (num_flex_bg-1))
- {
- num_groups = fs->last_block / tsk_getu32(fs->endian,sb->s_blocks_per_group);
- if (num_groups % tsk_getu32(fs->endian,sb->s_blocks_per_group))
- num_groups++;
- left_over = (num_groups % gpfbg);
- if(EXT2FS_HAS_INCOMPAT_FEATURE(fs, sb, EXT2FS_FEATURE_INCOMPAT_64BIT) && gd_size >= 64)
- {
+ if (i % gpfbg == 0) {
+ if (curr_flex_bg == (num_flex_bg - 1)) {
+ num_groups =
+ fs->last_block / tsk_getu32(fs->endian,
+ sb->s_blocks_per_group);
+ if (num_groups % tsk_getu32(fs->endian,
+ sb->s_blocks_per_group))
+ num_groups++;
+ left_over = (num_groups % gpfbg);
+ if (EXT2FS_HAS_INCOMPAT_FEATURE(fs, sb,
+ EXT2FS_FEATURE_INCOMPAT_64BIT) && gd_size >= 64) {
//DEBUG printf("DEBUG processing 64bit file system with 64 bit group descriptors");
tsk_fprintf(hFile, " Uninit Data Bitmaps: ");
tsk_fprintf(hFile, "%" PRIu64 " - %" PRIu64 "\n",
- ext4_getu64(fs->endian, ext4_gd->bg_block_bitmap_hi, ext2fs->ext4_grp_buf->bg_block_bitmap_lo)
- + (left_over),
- ext4_getu64(fs->endian, ext4_gd->bg_block_bitmap_hi, ext2fs->ext4_grp_buf->bg_block_bitmap_lo)
- + gpfbg -1 );
+ ext4_getu64(fs->endian, ext4_gd->bg_block_bitmap_hi,
+ ext2fs->ext4_grp_buf->bg_block_bitmap_lo)
+ + (left_over), ext4_getu64(fs->endian,
+ ext4_gd->bg_block_bitmap_hi,
+ ext2fs->ext4_grp_buf->bg_block_bitmap_lo)
+ + gpfbg - 1);
tsk_fprintf(hFile, " Uninit Inode Bitmaps: ");
tsk_fprintf(hFile, "%" PRIu64 " - %" PRIu64 "\n",
- ext4_getu64(fs->endian, ext4_gd->bg_inode_bitmap_hi, ext2fs->ext4_grp_buf->bg_inode_bitmap_lo)
- + (left_over),
- ext4_getu64(fs->endian, ext4_gd->bg_inode_bitmap_hi,ext2fs->ext4_grp_buf->bg_inode_bitmap_lo)
- + gpfbg - 1 );
+ ext4_getu64(fs->endian, ext4_gd->bg_inode_bitmap_hi,
+ ext2fs->ext4_grp_buf->bg_inode_bitmap_lo)
+ + (left_over), ext4_getu64(fs->endian,
+ ext4_gd->bg_inode_bitmap_hi,
+ ext2fs->ext4_grp_buf->bg_inode_bitmap_lo)
+ + gpfbg - 1);
tsk_fprintf(hFile, " Uninit Inode Table: ");
tsk_fprintf(hFile, "%" PRIu64 " - %" PRIu64 "\n",
- ext4_getu64(fs->endian, ext4_gd->bg_inode_table_hi,ext2fs->ext4_grp_buf->bg_inode_table_lo)
- +((left_over) * ibpg),
- ext4_getu64(fs->endian, ext4_gd->bg_inode_table_hi, ext2fs->ext4_grp_buf->bg_inode_table_lo)
- +(gpfbg * ibpg) - 1);
+ ext4_getu64(fs->endian, ext4_gd->bg_inode_table_hi,
+ ext2fs->ext4_grp_buf->bg_inode_table_lo)
+ + ((left_over) * ibpg), ext4_getu64(fs->endian,
+ ext4_gd->bg_inode_table_hi,
+ ext2fs->ext4_grp_buf->bg_inode_table_lo)
+ + (gpfbg * ibpg) - 1);
}
- else
- {
+ else {
tsk_fprintf(hFile, " Uninit Data Bitmaps: ");
tsk_fprintf(hFile, "%" PRIu32 " - %" PRIu32 "\n",
- tsk_getu32(fs->endian, ext2fs->ext4_grp_buf->bg_block_bitmap_lo)
- + (left_over),
- tsk_getu32(fs->endian, ext2fs->ext4_grp_buf->bg_block_bitmap_lo)
- + gpfbg - 1 );
+ tsk_getu32(fs->endian,
+ ext2fs->ext4_grp_buf->bg_block_bitmap_lo)
+ + (left_over), tsk_getu32(fs->endian,
+ ext2fs->ext4_grp_buf->bg_block_bitmap_lo)
+ + gpfbg - 1);
tsk_fprintf(hFile, " Uninit Inode Bitmaps: ");
tsk_fprintf(hFile, "%" PRIu32 " - %" PRIu32 "\n",
- tsk_getu32(fs->endian, ext2fs->ext4_grp_buf->bg_inode_bitmap_lo)
- + (left_over),
- tsk_getu32(fs->endian, ext2fs->ext4_grp_buf->bg_inode_bitmap_lo)
- + gpfbg - 1 );
+ tsk_getu32(fs->endian,
+ ext2fs->ext4_grp_buf->bg_inode_bitmap_lo)
+ + (left_over), tsk_getu32(fs->endian,
+ ext2fs->ext4_grp_buf->bg_inode_bitmap_lo)
+ + gpfbg - 1);
tsk_fprintf(hFile, " Uninit Inode Table: ");
tsk_fprintf(hFile, "%" PRIu32 " - %" PRIu32 "\n",
- tsk_getu32(fs->endian, ext2fs->ext4_grp_buf->bg_inode_table_lo)
- +((left_over) * ibpg),
- tsk_getu32(fs->endian, ext2fs->ext4_grp_buf->bg_inode_table_lo)
- +(gpfbg * ibpg) - 1);
+ tsk_getu32(fs->endian,
+ ext2fs->ext4_grp_buf->bg_inode_table_lo)
+ + ((left_over) * ibpg), tsk_getu32(fs->endian,
+ ext2fs->ext4_grp_buf->bg_inode_table_lo)
+ + (gpfbg * ibpg) - 1);
}
}
tsk_fprintf(hFile, " Data Blocks: ");
db_offset = 0;
- if(ext2fs_bg_has_super(tsk_getu32(fs->endian,sb->s_feature_ro_compat),i))
- {
- db_offset = cg_base
- + (gpfbg * 2) //To account for the bitmaps
- + (ibpg*gpfbg) //Combined inode tables
- + tsk_getu16(fs->endian, ext2fs->fs->pad_or_gdt.s_reserved_gdt_blocks) + gd_blocks //group descriptors
- +1; //superblock
+ if (ext2fs_bg_has_super(tsk_getu32(fs->endian,
+ sb->s_feature_ro_compat), i)) {
+ db_offset = cg_base + (gpfbg * 2) //To account for the bitmaps
+ + (ibpg * gpfbg) //Combined inode tables
+ + tsk_getu16(fs->endian, ext2fs->fs->pad_or_gdt.s_reserved_gdt_blocks) + gd_blocks //group descriptors
+ + 1; //superblock
}
- else
- {
- db_offset = cg_base
- + (gpfbg * 2) //To account for the bitmaps
- + (ibpg*gpfbg); //Combined inode tables
+ else {
+ db_offset = cg_base + (gpfbg * 2) //To account for the bitmaps
+ + (ibpg * gpfbg); //Combined inode tables
}
tsk_fprintf(hFile, "%" PRIuDADDR " - %" PRIuDADDR "\n",
db_offset, last_block);
}
- else
- {
+ else {
tsk_fprintf(hFile, " Data Blocks: ");
db_offset = 0;
- if(ext2fs_bg_has_super(tsk_getu32(fs->endian,sb->s_feature_ro_compat),i))
- {
- db_offset = cg_base
- + tsk_getu16(fs->endian, ext2fs->fs->pad_or_gdt.s_reserved_gdt_blocks) + gd_blocks //group descriptors
- +1; //superblock
+ if (ext2fs_bg_has_super(tsk_getu32(fs->endian,
+ sb->s_feature_ro_compat), i)) {
+ db_offset = cg_base + tsk_getu16(fs->endian, ext2fs->fs->pad_or_gdt.s_reserved_gdt_blocks) + gd_blocks //group descriptors
+ + 1; //superblock
}
- else
- {
+ else {
db_offset = cg_base;
}
tsk_fprintf(hFile, "%" PRIuDADDR " - %" PRIuDADDR "\n",
@@ -1842,21 +1907,22 @@ ext2fs_fsstat(TSK_FS_INFO * fs, FILE * hFile)
tsk_fprintf(hFile, "FILE SYSTEM INFORMATION\n");
tsk_fprintf(hFile, "--------------------------------------------\n");
- switch(fs->ftype) {
- case TSK_FS_TYPE_EXT3:
+ switch (fs->ftype) {
+ case TSK_FS_TYPE_EXT3:
tmptypename = "Ext3";
- gd_size=sizeof(ext2fs_gd);
+ gd_size = sizeof(ext2fs_gd);
break;
- case TSK_FS_TYPE_EXT4:
+ case TSK_FS_TYPE_EXT4:
tmptypename = "Ext4";
- if (EXT2FS_HAS_INCOMPAT_FEATURE(fs,sb,EXT2FS_FEATURE_INCOMPAT_64BIT))
- gd_size=sizeof(ext4fs_gd);
+ if (EXT2FS_HAS_INCOMPAT_FEATURE(fs, sb,
+ EXT2FS_FEATURE_INCOMPAT_64BIT))
+ gd_size = sizeof(ext4fs_gd);
else
- gd_size=sizeof(ext2fs_gd);
+ gd_size = sizeof(ext2fs_gd);
break;
- default:
+ default:
tmptypename = "Ext2";
- gd_size=sizeof(ext2fs_gd);
+ gd_size = sizeof(ext2fs_gd);
}
tsk_fprintf(hFile, "File System Type: %s\n", tmptypename);
tsk_fprintf(hFile, "Volume Name: %s\n", sb->s_volume_name);
@@ -1988,7 +2054,8 @@ ext2fs_fsstat(TSK_FS_INFO * fs, FILE * hFile)
if (tsk_getu32(fs->endian, sb->s_feature_ro_compat) &
EXT2FS_FEATURE_RO_COMPAT_LARGE_FILE)
tsk_fprintf(hFile, "Large File, ");
- if(EXT2FS_HAS_RO_COMPAT_FEATURE(fs,sb,EXT2FS_FEATURE_RO_COMPAT_HUGE_FILE))
+ if (EXT2FS_HAS_RO_COMPAT_FEATURE(fs, sb,
+ EXT2FS_FEATURE_RO_COMPAT_HUGE_FILE))
tsk_fprintf(hFile, "Huge File, ");
if (tsk_getu32(fs->endian, sb->s_feature_ro_compat) &
EXT2FS_FEATURE_RO_COMPAT_BTREE_DIR)
@@ -2032,8 +2099,7 @@ ext2fs_fsstat(TSK_FS_INFO * fs, FILE * hFile)
Only print size of inode for Ext4
This determines if you will get nanosecs and crtime
*/
- if(!strcmp(tmptypename, "Ext4"))
- {
+ if (!strcmp(tmptypename, "Ext4")) {
tsk_fprintf(hFile, "Inode Size: %" PRIu16 "\n",
tsk_getu16(fs->endian, sb->s_inode_size));
}
@@ -2074,9 +2140,8 @@ ext2fs_fsstat(TSK_FS_INFO * fs, FILE * hFile)
tsk_fprintf(hFile, "\nCONTENT INFORMATION\n");
tsk_fprintf(hFile, "--------------------------------------------\n");
- if(fs->ftype == TSK_FS_TYPE_EXT4)
- {
- tsk_fprintf(hFile,"Block Groups Per Flex Group: %" PRIu32 "\n",
+ if (fs->ftype == TSK_FS_TYPE_EXT4) {
+ tsk_fprintf(hFile, "Block Groups Per Flex Group: %" PRIu32 "\n",
(1 << sb->s_log_groups_per_flex));
gpfbg = (1 << sb->s_log_groups_per_flex);
}
@@ -2117,13 +2182,16 @@ ext2fs_fsstat(TSK_FS_INFO * fs, FILE * hFile)
sb->s_inodes_per_group) * ext2fs->inode_size + fs->block_size -
1) / fs->block_size;
/* number of blocks group descriptors consume */
- gd_blocks = (gd_size * ext2fs->groups_count + fs->block_size-1)/ fs->block_size;
+ gd_blocks =
+ (gd_size * ext2fs->groups_count + fs->block_size -
+ 1) / fs->block_size;
#ifdef Ext4_DBG
- tsk_fprintf(hFile, "\n\tDEBUG: Group Descriptor Size: %d\n", gd_size); //DEBUG
- tsk_fprintf(hFile, "\n\tDEBUG: Group Descriptor Size: %d\n", *sb->s_desc_size); //DEBUG
- debug_print_buf((unsigned char *)&sb->pad_or_gdt, 16);
- printf("\n\tDEBUG: gdt_growth: %d\n", tsk_getu16(fs->endian,sb->pad_or_gdt.s_reserved_gdt_blocks));
+ tsk_fprintf(hFile, "\n\tDEBUG: Group Descriptor Size: %d\n", gd_size); //DEBUG
+ tsk_fprintf(hFile, "\n\tDEBUG: Group Descriptor Size: %d\n", *sb->s_desc_size); //DEBUG
+ debug_print_buf((unsigned char *) &sb->pad_or_gdt, 16);
+ printf("\n\tDEBUG: gdt_growth: %d\n", tsk_getu16(fs->endian,
+ sb->pad_or_gdt.s_reserved_gdt_blocks));
#endif
for (i = 0; i < ext2fs->groups_count; i++) {
@@ -2138,15 +2206,18 @@ ext2fs_fsstat(TSK_FS_INFO * fs, FILE * hFile)
return 1;
}
tsk_fprintf(hFile, "\nGroup: %d:\n", i);
- if(fs->ftype == TSK_FS_TYPE_EXT4){
- tsk_fprintf(hFile," Block Group Flags: [");
- if(EXT4BG_HAS_FLAG(fs, ext2fs->ext4_grp_buf, EXT4_BG_INODE_UNINIT))
- tsk_fprintf(hFile,"INODE_UNINIT, ");
- if(EXT4BG_HAS_FLAG(fs, ext2fs->ext4_grp_buf, EXT4_BG_BLOCK_UNINIT))
- tsk_fprintf(hFile,"BLOCK_UNINIT, ");
- if(EXT4BG_HAS_FLAG(fs, ext2fs->ext4_grp_buf, EXT4_BG_INODE_ZEROED))
- tsk_fprintf(hFile,"INODE_ZEROED, ");
- tsk_fprintf(hFile,"\b\b]\n");
+ if (fs->ftype == TSK_FS_TYPE_EXT4) {
+ tsk_fprintf(hFile, " Block Group Flags: [");
+ if (EXT4BG_HAS_FLAG(fs, ext2fs->ext4_grp_buf,
+ EXT4_BG_INODE_UNINIT))
+ tsk_fprintf(hFile, "INODE_UNINIT, ");
+ if (EXT4BG_HAS_FLAG(fs, ext2fs->ext4_grp_buf,
+ EXT4_BG_BLOCK_UNINIT))
+ tsk_fprintf(hFile, "BLOCK_UNINIT, ");
+ if (EXT4BG_HAS_FLAG(fs, ext2fs->ext4_grp_buf,
+ EXT4_BG_INODE_ZEROED))
+ tsk_fprintf(hFile, "INODE_ZEROED, ");
+ tsk_fprintf(hFile, "\b\b]\n");
}
inum =
fs->first_inum + tsk_gets32(fs->endian,
@@ -2160,46 +2231,52 @@ ext2fs_fsstat(TSK_FS_INFO * fs, FILE * hFile)
else
tsk_fprintf(hFile, "%" PRIuINUM "\n", fs->last_inum);
- if (tsk_getu32(fs->endian, ext2fs->fs->s_feature_incompat) & EXT2FS_FEATURE_INCOMPAT_64BIT)
- {
+ if (tsk_getu32(fs->endian,
+ ext2fs->fs->
+ s_feature_incompat) & EXT2FS_FEATURE_INCOMPAT_64BIT) {
cg_base = ext4_cgbase_lcl(fs, sb, i);
#ifdef Ext4_DBG
- printf("DEBUG64: ext2_cgbase_lcl %"PRIuDADDR"\n", cg_base);
- printf("DEBUG64: fs->s_first_data_block %"PRIuDADDR"\n", tsk_getu32(fs->endian, sb->s_first_data_block));
- printf("DEBUG64: blocks_per_group %"PRIuDADDR"\n", tsk_getu32(fs->endian, sb->s_blocks_per_group));
- printf("DEBUG64: i %"PRIuDADDR" %"PRIuDADDR" %"PRIuDADDR"\n", i, tsk_getu32(fs->endian, sb->s_blocks_per_group),(uint64_t)i * (uint64_t)tsk_getu32(fs->endian, sb->s_blocks_per_group));
- //printf("DEBUG: calculated %"PRIuDADDR"\n", )
+ printf("DEBUG64: ext2_cgbase_lcl %" PRIuDADDR "\n", cg_base);
+ printf("DEBUG64: fs->s_first_data_block %" PRIuDADDR "\n",
+ tsk_getu32(fs->endian, sb->s_first_data_block));
+ printf("DEBUG64: blocks_per_group %" PRIuDADDR "\n",
+ tsk_getu32(fs->endian, sb->s_blocks_per_group));
+ printf("DEBUG64: i %" PRIuDADDR " %" PRIuDADDR " %" PRIuDADDR
+ "\n", i, tsk_getu32(fs->endian, sb->s_blocks_per_group),
+ (uint64_t) i * (uint64_t) tsk_getu32(fs->endian,
+ sb->s_blocks_per_group));
+ //printf("DEBUG: calculated %"PRIuDADDR"\n", )
#endif
tsk_fprintf(hFile,
- " Block Range: %" PRIuDADDR " - %" PRIuDADDR "\n", cg_base,
- ((ext4_cgbase_lcl(fs, sb,
+ " Block Range: %" PRIuDADDR " - %" PRIuDADDR "\n",
+ cg_base, ((ext4_cgbase_lcl(fs, sb,
i + 1) - 1) <
fs->last_block) ? (ext4_cgbase_lcl(fs, sb,
i + 1) - 1) : fs->last_block);
- }
- else
- {
+ }
+ else {
cg_base = ext2_cgbase_lcl(fs, sb, i);
#ifdef Ext4_DBG
- debug_print_buf(sb, 100);
- printf("DEBUG32: ext2_cgbase_lcl %"PRIuDADDR"\n", cg_base);
- printf("DEBUG32: fs->s_first_data_block %"PRIu32"\n",
- tsk_getu32(fs->endian, sb->s_first_data_block));
- printf("DEBUG32: blocks_per_group %"PRIu32"\n",
- tsk_getu32(fs->endian, sb->s_blocks_per_group));
- printf("DEBUG32: i: %"PRIu32" blocks per group: %"PRIu32
- " i*blocks_per_group: %"PRIu32"\n",
- i, tsk_getu32(fs->endian, sb->s_blocks_per_group),
- (uint64_t)i * (uint64_t)tsk_getu32(fs->endian, sb->s_blocks_per_group));
- //printf("DEBUG: calculated %"PRIuDADDR"\n", )
+ debug_print_buf(sb, 100);
+ printf("DEBUG32: ext2_cgbase_lcl %" PRIuDADDR "\n", cg_base);
+ printf("DEBUG32: fs->s_first_data_block %" PRIu32 "\n",
+ tsk_getu32(fs->endian, sb->s_first_data_block));
+ printf("DEBUG32: blocks_per_group %" PRIu32 "\n",
+ tsk_getu32(fs->endian, sb->s_blocks_per_group));
+ printf("DEBUG32: i: %" PRIu32 " blocks per group: %" PRIu32
+ " i*blocks_per_group: %" PRIu32 "\n",
+ i, tsk_getu32(fs->endian, sb->s_blocks_per_group),
+ (uint64_t) i * (uint64_t) tsk_getu32(fs->endian,
+ sb->s_blocks_per_group));
+ //printf("DEBUG: calculated %"PRIuDADDR"\n", )
#endif
tsk_fprintf(hFile,
- " Block Range: %" PRIuDADDR " - %" PRIuDADDR "\n", cg_base,
- ((ext2_cgbase_lcl(fs, sb,
+ " Block Range: %" PRIuDADDR " - %" PRIuDADDR "\n",
+ cg_base, ((ext2_cgbase_lcl(fs, sb,
i + 1) - 1) <
fs->last_block) ? (ext2_cgbase_lcl(fs, sb,
i + 1) - 1) : fs->last_block);
- }
+ }
@@ -2209,8 +2286,9 @@ ext2fs_fsstat(TSK_FS_INFO * fs, FILE * hFile)
* group
*/
#ifdef Ext4_DBG
- printf("DEBUG: ext2fs_super: %d\n",
- ext2fs_bg_has_super(tsk_getu32(fs->endian,sb->s_feature_ro_compat),i));
+ printf("DEBUG: ext2fs_super: %d\n",
+ ext2fs_bg_has_super(tsk_getu32(fs->endian,
+ sb->s_feature_ro_compat), i));
#endif
/* if (((tsk_getu32(fs->endian, ext2fs->fs->s_feature_ro_compat) &
EXT2FS_FEATURE_RO_COMPAT_SPARSE_SUPER) &&
@@ -2220,7 +2298,8 @@ ext2fs_fsstat(TSK_FS_INFO * fs, FILE * hFile)
ext2fs->fs->s_feature_ro_compat) &
EXT2FS_FEATURE_RO_COMPAT_SPARSE_SUPER) == 0)) {
*/
- if(ext2fs_bg_has_super(tsk_getu32(fs->endian,sb->s_feature_ro_compat),i)) {
+ if (ext2fs_bg_has_super(tsk_getu32(fs->endian,
+ sb->s_feature_ro_compat), i)) {
TSK_OFF_T boff;
/* the super block is the first 1024 bytes */
@@ -2244,101 +2323,113 @@ ext2fs_fsstat(TSK_FS_INFO * fs, FILE * hFile)
((cg_base +
(boff + fs->block_size - 1) / fs->block_size) -
1));
- if(fs->ftype == TSK_FS_TYPE_EXT4)
- {
+ if (fs->ftype == TSK_FS_TYPE_EXT4) {
tsk_fprintf(hFile,
- " Group Descriptor Growth Blocks: %" PRIuDADDR " - ", cg_base + (boff + fs->block_size -1)/fs->block_size);
- boff += tsk_getu16(fs->endian, ext2fs->fs->pad_or_gdt.s_reserved_gdt_blocks) * fs->block_size;
+ " Group Descriptor Growth Blocks: %" PRIuDADDR
+ " - ",
+ cg_base + (boff + fs->block_size -
+ 1) / fs->block_size);
+ boff +=
+ tsk_getu16(fs->endian,
+ ext2fs->fs->pad_or_gdt.s_reserved_gdt_blocks) *
+ fs->block_size;
tsk_fprintf(hFile, "%" PRIuDADDR "\n",
- ((cg_base +
- (boff + fs->block_size - 1) / fs->block_size) -
- 1));
+ ((cg_base + (boff + fs->block_size -
+ 1) / fs->block_size) - 1));
}
}
- if (tsk_getu32(fs->endian, ext2fs->fs->s_feature_incompat) & EXT2FS_FEATURE_INCOMPAT_64BIT)
- {
+ if (tsk_getu32(fs->endian,
+ ext2fs->fs->
+ s_feature_incompat) & EXT2FS_FEATURE_INCOMPAT_64BIT) {
/* The block bitmap is a full block */
- tsk_fprintf(hFile, " Data bitmap: %" PRIu64 " - %" PRIu64 "\n",
- ext4_getu64(fs->endian,
- ext2fs->ext4_grp_buf->bg_block_bitmap_hi,
- ext2fs->ext4_grp_buf->bg_block_bitmap_lo),
- ext4_getu64(fs->endian,
- ext2fs->ext4_grp_buf->bg_block_bitmap_hi,
- ext2fs->ext4_grp_buf->bg_block_bitmap_lo));
-
-
+ tsk_fprintf(hFile,
+ " Data bitmap: %" PRIu64 " - %" PRIu64 "\n",
+ ext4_getu64(fs->endian,
+ ext2fs->ext4_grp_buf->bg_block_bitmap_hi,
+ ext2fs->ext4_grp_buf->bg_block_bitmap_lo),
+ ext4_getu64(fs->endian,
+ ext2fs->ext4_grp_buf->bg_block_bitmap_hi,
+ ext2fs->ext4_grp_buf->bg_block_bitmap_lo));
+
+
/* The inode bitmap is a full block */
- tsk_fprintf(hFile, " Inode bitmap: %" PRIu64 " - %" PRIu64 "\n",
- ext4_getu64(fs->endian,
- ext2fs->ext4_grp_buf->bg_inode_bitmap_hi,
- ext2fs->ext4_grp_buf->bg_inode_bitmap_lo),
- ext4_getu64(fs->endian,
- ext2fs->ext4_grp_buf->bg_inode_bitmap_hi,
- ext2fs->ext4_grp_buf->bg_inode_bitmap_lo));
-
-
- tsk_fprintf(hFile, " Inode Table: %" PRIu64 " - %" PRIu64 "\n",
- ext4_getu64(fs->endian,
- ext2fs->ext4_grp_buf->bg_inode_table_hi,
- ext2fs->ext4_grp_buf->bg_inode_table_lo),
+ tsk_fprintf(hFile,
+ " Inode bitmap: %" PRIu64 " - %" PRIu64 "\n",
+ ext4_getu64(fs->endian,
+ ext2fs->ext4_grp_buf->bg_inode_bitmap_hi,
+ ext2fs->ext4_grp_buf->bg_inode_bitmap_lo),
ext4_getu64(fs->endian,
- ext2fs->ext4_grp_buf->bg_inode_table_hi,
- ext2fs->ext4_grp_buf->bg_inode_table_lo)
- + ibpg - 1);
- }
- else
- {
+ ext2fs->ext4_grp_buf->bg_inode_bitmap_hi,
+ ext2fs->ext4_grp_buf->bg_inode_bitmap_lo));
+
+
+ tsk_fprintf(hFile,
+ " Inode Table: %" PRIu64 " - %" PRIu64 "\n",
+ ext4_getu64(fs->endian,
+ ext2fs->ext4_grp_buf->bg_inode_table_hi,
+ ext2fs->ext4_grp_buf->bg_inode_table_lo),
+ ext4_getu64(fs->endian,
+ ext2fs->ext4_grp_buf->bg_inode_table_hi,
+ ext2fs->ext4_grp_buf->bg_inode_table_lo)
+ + ibpg - 1);
+ }
+ else {
/* The block bitmap is a full block */
- tsk_fprintf(hFile, " Data bitmap: %" PRIu32 " - %" PRIu32 "\n",
+ tsk_fprintf(hFile,
+ " Data bitmap: %" PRIu32 " - %" PRIu32 "\n",
tsk_getu32(fs->endian, ext2fs->grp_buf->bg_block_bitmap),
tsk_getu32(fs->endian, ext2fs->grp_buf->bg_block_bitmap));
-
-
+
+
/* The inode bitmap is a full block */
- tsk_fprintf(hFile, " Inode bitmap: %" PRIu32 " - %" PRIu32 "\n",
+ tsk_fprintf(hFile,
+ " Inode bitmap: %" PRIu32 " - %" PRIu32 "\n",
tsk_getu32(fs->endian, ext2fs->grp_buf->bg_inode_bitmap),
tsk_getu32(fs->endian, ext2fs->grp_buf->bg_inode_bitmap));
-
-
- tsk_fprintf(hFile, " Inode Table: %" PRIu32 " - %" PRIu32 "\n",
+
+
+ tsk_fprintf(hFile,
+ " Inode Table: %" PRIu32 " - %" PRIu32 "\n",
tsk_getu32(fs->endian, ext2fs->grp_buf->bg_inode_table),
tsk_getu32(fs->endian,
ext2fs->grp_buf->bg_inode_table) + ibpg - 1);
}
- /* If we are in a sparse group, display the other addresses */
- if(fs->ftype == TSK_FS_TYPE_EXT4)
- {
+ /* If we are in a sparse group, display the other addresses */
+ if (fs->ftype == TSK_FS_TYPE_EXT4) {
ext4_fsstat_datablock_helper(fs, hFile, i, cg_base, gd_size);
}
- else
- {
- if(ext2fs_bg_has_super(tsk_getu32(fs->endian,sb->s_feature_ro_compat),i)) {
-/* if ((tsk_getu32(fs->endian, ext2fs->fs->s_feature_ro_compat) &
+ else {
+ tsk_fprintf(hFile, " Data Blocks: ");
+ // BC: Commented out from Ext4 commit because it produced
+ // bad data on Ext2 test image.
+ //if (ext2fs_bg_has_super(tsk_getu32(fs->endian,
+ // sb->s_feature_ro_compat), i)) {
+ if ((tsk_getu32(fs->endian, ext2fs->fs->s_feature_ro_compat) &
EXT2FS_FEATURE_RO_COMPAT_SPARSE_SUPER) &&
(cg_base == tsk_getu32(fs->endian,
ext2fs->grp_buf->bg_block_bitmap))) {
-*/
- /* it goes from the end of the inode bitmap to before the
- * table
- *
- * This hard coded aspect does not scale ...
- */
- tsk_fprintf(hFile, " Data Blocks: ");
- tsk_fprintf(hFile, "%" PRIu32 " - %" PRIu32 ", ",
- tsk_getu32(fs->endian,
- ext2fs->grp_buf->bg_inode_bitmap) + 1,
- tsk_getu32(fs->endian,
- ext2fs->grp_buf->bg_inode_table) - 1);
- }
- tsk_fprintf(hFile, " Data Blocks: ");
- tsk_fprintf(hFile, "%" PRIu32 " - %" PRIu32 "\n",
- (uint64_t) tsk_getu32(fs->endian,
- ext2fs->grp_buf->bg_inode_table) + ibpg,
- ((ext2_cgbase_lcl(fs, sb, i + 1) - 1) <
- fs->last_block) ? (ext2_cgbase_lcl(fs, sb,
- i + 1) - 1) : fs->last_block);
+
+ /* it goes from the end of the inode bitmap to before the
+ * table
+ *
+ * This hard coded aspect does not scale ...
+ */
+
+ tsk_fprintf(hFile, "%" PRIu32 " - %" PRIu32 ", ",
+ tsk_getu32(fs->endian,
+ ext2fs->grp_buf->bg_inode_bitmap) + 1,
+ tsk_getu32(fs->endian,
+ ext2fs->grp_buf->bg_inode_table) - 1);
+ }
+
+ tsk_fprintf(hFile, "%" PRIu32 " - %" PRIu32 "\n",
+ (uint64_t) tsk_getu32(fs->endian,
+ ext2fs->grp_buf->bg_inode_table) + ibpg,
+ ((ext2_cgbase_lcl(fs, sb, i + 1) - 1) <
+ fs->last_block) ? (ext2_cgbase_lcl(fs, sb,
+ i + 1) - 1) : fs->last_block);
}
/* Print the free info */
@@ -2366,7 +2457,8 @@ ext2fs_fsstat(TSK_FS_INFO * fs, FILE * hFile)
TSK_DADDR_T blk_left;
inum_left =
- (fs->last_inum % tsk_gets32(fs->endian,sb->s_inodes_per_group)) -1;
+ (fs->last_inum % tsk_gets32(fs->endian,
+ sb->s_inodes_per_group)) - 1;
if (inum_left == 0)
inum_left = tsk_getu32(fs->endian, sb->s_inodes_per_group);
@@ -2375,8 +2467,7 @@ ext2fs_fsstat(TSK_FS_INFO * fs, FILE * hFile)
tsk_getu16(fs->endian,
ext2fs->grp_buf->bg_free_inodes_count),
100 * tsk_getu16(fs->endian,
- ext2fs->grp_buf->bg_free_inodes_count) /
- inum_left);
+ ext2fs->grp_buf->bg_free_inodes_count) / inum_left);
/* Now blocks */
blk_left =
@@ -2389,19 +2480,19 @@ ext2fs_fsstat(TSK_FS_INFO * fs, FILE * hFile)
tsk_getu16(fs->endian,
ext2fs->grp_buf->bg_free_blocks_count),
100 * tsk_getu16(fs->endian,
- ext2fs->grp_buf->bg_free_blocks_count) /
- blk_left);
+ ext2fs->grp_buf->bg_free_blocks_count) / blk_left);
}
tsk_fprintf(hFile, " Total Directories: %" PRIu16 "\n",
tsk_getu16(fs->endian, ext2fs->grp_buf->bg_used_dirs_count));
- if(fs->ftype == TSK_FS_TYPE_EXT4){
- tsk_fprintf(hFile, " Stored Checksum: 0x%04" PRIX16 "\n",
- tsk_getu16(fs->endian,ext2fs->ext4_grp_buf->bg_checksum));
+ if (fs->ftype == TSK_FS_TYPE_EXT4) {
+ tsk_fprintf(hFile, " Stored Checksum: 0x%04" PRIX16 "\n",
+ tsk_getu16(fs->endian, ext2fs->ext4_grp_buf->bg_checksum));
#ifdef EXT4_CHECKSUMS
//Need Non-GPL CRC16
- tsk_fprintf(hFile, " Calculated Checksum: 0x%04" PRIX16 "\n",ext4_group_desc_csum(ext2fs->fs, i, ext2fs->ext4_grp_buf));
+ tsk_fprintf(hFile, " Calculated Checksum: 0x%04" PRIX16 "\n",
+ ext4_group_desc_csum(ext2fs->fs, i, ext2fs->ext4_grp_buf));
#endif
}
@@ -2506,18 +2597,17 @@ ext2fs_istat(TSK_FS_INFO * fs, FILE * hFile, TSK_INUM_T inum,
// clean up any error messages that are lying around
tsk_error_reset();
- if (ext2fs->inode_size > 128)
- {
+ if (ext2fs->inode_size > 128) {
large_inodes = 1;
}
- else
- {
+ else {
large_inodes = 0;
}
- size = ext2fs->inode_size > sizeof(ext2fs_inode) ? ext2fs->inode_size : sizeof(ext2fs_inode);
- if ((dino_buf =
- (ext2fs_inode *) tsk_malloc(size)) == NULL) {
+ size =
+ ext2fs->inode_size >
+ sizeof(ext2fs_inode) ? ext2fs->inode_size : sizeof(ext2fs_inode);
+ if ((dino_buf = (ext2fs_inode *) tsk_malloc(size)) == NULL) {
return 1;
}
@@ -2585,61 +2675,48 @@ ext2fs_istat(TSK_FS_INFO * fs, FILE * hFile, TSK_INUM_T inum,
if (tsk_getu32(fs->endian, dino_buf->i_flags) & EXT2_IN_NOA)
tsk_fprintf(hFile, "No A-Time, ");
- if (tsk_getu32(fs->endian,
- dino_buf->i_flags) & EXT2_IN_DIRTY)
- tsk_fprintf(hFile, "Dirty Compressed File, ");
+ if (tsk_getu32(fs->endian, dino_buf->i_flags) & EXT2_IN_DIRTY)
+ tsk_fprintf(hFile, "Dirty Compressed File, ");
- if (tsk_getu32(fs->endian,
- dino_buf->i_flags) & EXT2_IN_COMPRBLK)
- tsk_fprintf(hFile, "Compressed Clusters, ");
+ if (tsk_getu32(fs->endian, dino_buf->i_flags) & EXT2_IN_COMPRBLK)
+ tsk_fprintf(hFile, "Compressed Clusters, ");
- if (tsk_getu32(fs->endian,
- dino_buf->i_flags) & EXT2_IN_NOCOMPR)
- tsk_fprintf(hFile, "Do Not Compress, ");
+ if (tsk_getu32(fs->endian, dino_buf->i_flags) & EXT2_IN_NOCOMPR)
+ tsk_fprintf(hFile, "Do Not Compress, ");
- if (tsk_getu32(fs->endian,
- dino_buf->i_flags) & EXT2_IN_ECOMPR)
- tsk_fprintf(hFile, "Compression Error, ");
+ if (tsk_getu32(fs->endian, dino_buf->i_flags) & EXT2_IN_ECOMPR)
+ tsk_fprintf(hFile, "Compression Error, ");
- if (tsk_getu32(fs->endian,
- dino_buf->i_flags) & EXT2_IN_INDEX)
- tsk_fprintf(hFile, "Hash Indexed Directory, ");
+ if (tsk_getu32(fs->endian, dino_buf->i_flags) & EXT2_IN_INDEX)
+ tsk_fprintf(hFile, "Hash Indexed Directory, ");
- if (tsk_getu32(fs->endian,
- dino_buf->i_flags) & EXT2_IN_IMAGIC)
- tsk_fprintf(hFile, "AFS Magic Directory, ");
+ if (tsk_getu32(fs->endian, dino_buf->i_flags) & EXT2_IN_IMAGIC)
+ tsk_fprintf(hFile, "AFS Magic Directory, ");
- if (tsk_getu32(fs->endian,
- dino_buf->i_flags) & EXT2_IN_JOURNAL_DATA)
- tsk_fprintf(hFile, "Journal Data, ");
+ if (tsk_getu32(fs->endian,
+ dino_buf->i_flags) & EXT2_IN_JOURNAL_DATA)
+ tsk_fprintf(hFile, "Journal Data, ");
- if (tsk_getu32(fs->endian,
- dino_buf->i_flags) & EXT2_IN_NOTAIL)
- tsk_fprintf(hFile, "Do Not Merge Tail, ");
+ if (tsk_getu32(fs->endian, dino_buf->i_flags) & EXT2_IN_NOTAIL)
+ tsk_fprintf(hFile, "Do Not Merge Tail, ");
- if (tsk_getu32(fs->endian,
- dino_buf->i_flags) & EXT2_IN_DIRSYNC)
- tsk_fprintf(hFile, "Directory Sync, ");
+ if (tsk_getu32(fs->endian, dino_buf->i_flags) & EXT2_IN_DIRSYNC)
+ tsk_fprintf(hFile, "Directory Sync, ");
- if (tsk_getu32(fs->endian,
- dino_buf->i_flags) & EXT2_IN_TOPDIR)
- tsk_fprintf(hFile, "Top Directory, ");
+ if (tsk_getu32(fs->endian, dino_buf->i_flags) & EXT2_IN_TOPDIR)
+ tsk_fprintf(hFile, "Top Directory, ");
- if (tsk_getu32(fs->endian,
- dino_buf->i_flags) & EXT2_IN_HUGE_FILE)
- tsk_fprintf(hFile, "Huge File, ");
+ if (tsk_getu32(fs->endian, dino_buf->i_flags) & EXT2_IN_HUGE_FILE)
+ tsk_fprintf(hFile, "Huge File, ");
- if (tsk_getu32(fs->endian,
- dino_buf->i_flags) & EXT2_IN_EXTENTS)
- tsk_fprintf(hFile, "Extents, ");
+ if (tsk_getu32(fs->endian, dino_buf->i_flags) & EXT2_IN_EXTENTS)
+ tsk_fprintf(hFile, "Extents, ");
- if (tsk_getu32(fs->endian,
- dino_buf->i_flags) & EXT2_IN_EA_INODE)
- tsk_fprintf(hFile, "Large Extended Attribute, ");
+ if (tsk_getu32(fs->endian, dino_buf->i_flags) & EXT2_IN_EA_INODE)
+ tsk_fprintf(hFile, "Large Extended Attribute, ");
- if (tsk_getu32(fs->endian,
- dino_buf->i_flags) & EXT2_IN_EOFBLOCKS)
- tsk_fprintf(hFile, "Blocks Allocated Beyond EOF, ");
+ if (tsk_getu32(fs->endian, dino_buf->i_flags) & EXT2_IN_EOFBLOCKS)
+ tsk_fprintf(hFile, "Blocks Allocated Beyond EOF, ");
tsk_fprintf(hFile, "\n");
@@ -2884,17 +2961,18 @@ ext2fs_istat(TSK_FS_INFO * fs, FILE * hFile, TSK_INUM_T inum,
fs_meta->ctime -= sec_skew;
- if(fs->ftype == TSK_FS_TYPE_EXT4 && large_inodes)
- {
+ if (fs->ftype == TSK_FS_TYPE_EXT4 && large_inodes) {
tsk_fprintf(hFile, "Accessed:\t%s\n",
- tsk_fs_time_to_str_subsecs(fs_meta->atime, fs_meta->atime_nano, timeBuf));
+ tsk_fs_time_to_str_subsecs(fs_meta->atime,
+ fs_meta->atime_nano, timeBuf));
tsk_fprintf(hFile, "File Modified:\t%s\n",
- tsk_fs_time_to_str_subsecs(fs_meta->mtime, fs_meta->mtime_nano, timeBuf));
+ tsk_fs_time_to_str_subsecs(fs_meta->mtime,
+ fs_meta->mtime_nano, timeBuf));
tsk_fprintf(hFile, "Inode Modified:\t%s\n",
- tsk_fs_time_to_str_subsecs(fs_meta->ctime, fs_meta->ctime_nano, timeBuf));
+ tsk_fs_time_to_str_subsecs(fs_meta->ctime,
+ fs_meta->ctime_nano, timeBuf));
}
- else
- {
+ else {
tsk_fprintf(hFile, "Accessed:\t%s\n",
tsk_fs_time_to_str(fs_meta->atime, timeBuf));
tsk_fprintf(hFile, "File Modified:\t%s\n",
@@ -2903,7 +2981,7 @@ ext2fs_istat(TSK_FS_INFO * fs, FILE * hFile, TSK_INUM_T inum,
tsk_fs_time_to_str(fs_meta->ctime, timeBuf));
}
- if(fs->ftype == TSK_FS_TYPE_EXT4 && large_inodes) {
+ if (fs->ftype == TSK_FS_TYPE_EXT4 && large_inodes) {
fs_meta->crtime -= sec_skew;
tsk_fprintf(hFile, "File Created:\t%s\n",
tsk_fs_time_to_str(fs_meta->crtime, timeBuf));
@@ -2931,17 +3009,18 @@ ext2fs_istat(TSK_FS_INFO * fs, FILE * hFile, TSK_INUM_T inum,
tsk_fprintf(hFile, "\nInode Times:\n");
}
- if(fs->ftype == TSK_FS_TYPE_EXT4 && large_inodes)
- {
+ if (fs->ftype == TSK_FS_TYPE_EXT4 && large_inodes) {
tsk_fprintf(hFile, "Accessed:\t%s\n",
- tsk_fs_time_to_str_subsecs(fs_meta->atime, fs_meta->atime_nano, timeBuf));
+ tsk_fs_time_to_str_subsecs(fs_meta->atime, fs_meta->atime_nano,
+ timeBuf));
tsk_fprintf(hFile, "File Modified:\t%s\n",
- tsk_fs_time_to_str_subsecs(fs_meta->mtime, fs_meta->mtime_nano, timeBuf));
+ tsk_fs_time_to_str_subsecs(fs_meta->mtime, fs_meta->mtime_nano,
+ timeBuf));
tsk_fprintf(hFile, "Inode Modified:\t%s\n",
- tsk_fs_time_to_str_subsecs(fs_meta->ctime, fs_meta->ctime_nano, timeBuf));
+ tsk_fs_time_to_str_subsecs(fs_meta->ctime, fs_meta->ctime_nano,
+ timeBuf));
}
- else
- {
+ else {
tsk_fprintf(hFile, "Accessed:\t%s\n",
tsk_fs_time_to_str(fs_meta->atime, timeBuf));
tsk_fprintf(hFile, "File Modified:\t%s\n",
@@ -2952,9 +3031,10 @@ ext2fs_istat(TSK_FS_INFO * fs, FILE * hFile, TSK_INUM_T inum,
- if(fs->ftype == TSK_FS_TYPE_EXT4 && large_inodes) {
+ if (fs->ftype == TSK_FS_TYPE_EXT4 && large_inodes) {
tsk_fprintf(hFile, "File Created:\t%s\n",
- tsk_fs_time_to_str_subsecs(fs_meta->crtime, fs_meta->crtime_nano, timeBuf));
+ tsk_fs_time_to_str_subsecs(fs_meta->crtime,
+ fs_meta->crtime_nano, timeBuf));
}
if (fs_meta->time2.ext2.dtime)
tsk_fprintf(hFile, "Deleted:\t%s\n",
@@ -2979,15 +3059,19 @@ ext2fs_istat(TSK_FS_INFO * fs, FILE * hFile, TSK_INUM_T inum,
}
if (fs_meta->content_type == TSK_FS_META_CONTENT_TYPE_EXT4_EXTENTS) {
- const TSK_FS_ATTR *fs_attr_extent = tsk_fs_file_attr_get_type(fs_file, TSK_FS_ATTR_TYPE_UNIX_EXTENT, 0, 0);
+ const TSK_FS_ATTR *fs_attr_extent =
+ tsk_fs_file_attr_get_type(fs_file,
+ TSK_FS_ATTR_TYPE_UNIX_EXTENT, 0, 0);
if (fs_attr_extent) {
tsk_fprintf(hFile, "\nExtent Blocks:\n");
print.idx = 0;
- if (tsk_fs_attr_walk(fs_attr_extent, TSK_FS_FILE_WALK_FLAG_AONLY,
- print_addr_act, (void *) &print)) {
- tsk_fprintf(hFile, "\nError reading indirect attribute: ");
+ if (tsk_fs_attr_walk(fs_attr_extent,
+ TSK_FS_FILE_WALK_FLAG_AONLY, print_addr_act,
+ (void *) &print)) {
+ tsk_fprintf(hFile,
+ "\nError reading indirect attribute: ");
tsk_error_print(hFile);
tsk_error_reset();
}
@@ -3004,9 +3088,11 @@ ext2fs_istat(TSK_FS_INFO * fs, FILE * hFile, TSK_INUM_T inum,
print.idx = 0;
- if (tsk_fs_attr_walk(fs_attr_indir, TSK_FS_FILE_WALK_FLAG_AONLY,
- print_addr_act, (void *) &print)) {
- tsk_fprintf(hFile, "\nError reading indirect attribute: ");
+ if (tsk_fs_attr_walk(fs_attr_indir,
+ TSK_FS_FILE_WALK_FLAG_AONLY, print_addr_act,
+ (void *) &print)) {
+ tsk_fprintf(hFile,
+ "\nError reading indirect attribute: ");
tsk_error_print(hFile);
tsk_error_reset();
}
@@ -3137,7 +3223,7 @@ ext2fs_open(TSK_IMG_INFO * img_info, TSK_OFF_T offset,
/* If autodetect was given, look for the journal */
if (ftype == TSK_FS_TYPE_EXT_DETECT) {
if (tsk_getu32(fs->endian, ext2fs->fs->s_feature_incompat) &
- EXT2FS_FEATURE_INCOMPAT_EXTENTS){
+ EXT2FS_FEATURE_INCOMPAT_EXTENTS) {
fs->ftype = TSK_FS_TYPE_EXT4;
fs->flags |= TSK_FS_INFO_FLAG_HAVE_NANOSEC;
}
@@ -3184,8 +3270,7 @@ ext2fs_open(TSK_IMG_INFO * img_info, TSK_OFF_T offset,
ext2fs->inode_size = tsk_getu16(fs->endian, ext2fs->fs->s_inode_size);
if (ext2fs->inode_size < sizeof(ext2fs_inode)) {
if (tsk_verbose)
- tsk_fprintf(stderr,
- "SB inode size is small");
+ tsk_fprintf(stderr, "SB inode size is small");
}
@@ -3193,14 +3278,17 @@ ext2fs_open(TSK_IMG_INFO * img_info, TSK_OFF_T offset,
* Calculate the block info
*/
fs->dev_bsize = img_info->sector_size;
- if (tsk_getu32(fs->endian, ext2fs->fs->s_feature_incompat) & EXT2FS_FEATURE_INCOMPAT_64BIT)
- {
+ if (tsk_getu32(fs->endian,
+ ext2fs->fs->
+ s_feature_incompat) & EXT2FS_FEATURE_INCOMPAT_64BIT) {
// printf("DEBUG fs_open: 64bit file system\n");
- fs->block_count = ext4_getu64(fs->endian, ext2fs->fs->s_blocks_count_hi, ext2fs->fs->s_blocks_count);
+ fs->block_count =
+ ext4_getu64(fs->endian, ext2fs->fs->s_blocks_count_hi,
+ ext2fs->fs->s_blocks_count);
}
- else
- {
- fs->block_count = tsk_getu32(fs->endian, ext2fs->fs->s_blocks_count);
+ else {
+ fs->block_count =
+ tsk_getu32(fs->endian, ext2fs->fs->s_blocks_count);
}
fs->first_block = 0;
fs->last_block_act = fs->last_block = fs->block_count - 1;
@@ -3238,21 +3326,25 @@ ext2fs_open(TSK_IMG_INFO * img_info, TSK_OFF_T offset,
ext2fs->groups_offset =
roundup((EXT2FS_SBOFF + sizeof(ext2fs_sb)), fs->block_size);
- if (tsk_getu32(fs->endian, ext2fs->fs->s_feature_incompat) & EXT2FS_FEATURE_INCOMPAT_64BIT)
- {
- ext2fs->groups_count =
- (EXT2_GRPNUM_T) ((ext4_getu64(fs->endian, ext2fs->fs->s_blocks_count_hi, ext2fs->fs->s_blocks_count)
- - ext2fs->first_data_block +
- tsk_getu32(fs->endian,ext2fs->fs->s_blocks_per_group) - 1)
- / tsk_getu32(fs->endian, ext2fs->fs->s_blocks_per_group));
+ if (tsk_getu32(fs->endian,
+ ext2fs->fs->
+ s_feature_incompat) & EXT2FS_FEATURE_INCOMPAT_64BIT) {
+ ext2fs->groups_count =
+ (EXT2_GRPNUM_T) ((ext4_getu64(fs->endian,
+ ext2fs->fs->s_blocks_count_hi,
+ ext2fs->fs->s_blocks_count)
+ - ext2fs->first_data_block + tsk_getu32(fs->endian,
+ ext2fs->fs->s_blocks_per_group) - 1)
+ / tsk_getu32(fs->endian, ext2fs->fs->s_blocks_per_group));
}
- else{
+ else {
ext2fs->groups_count =
- (EXT2_GRPNUM_T) ((tsk_getu32(fs->endian,
- ext2fs->fs->s_blocks_count) - ext2fs->first_data_block +
- tsk_getu32(fs->endian,
- ext2fs->fs->s_blocks_per_group) -
- 1) / tsk_getu32(fs->endian, ext2fs->fs->s_blocks_per_group));
+ (EXT2_GRPNUM_T) ((tsk_getu32(fs->endian,
+ ext2fs->fs->s_blocks_count) -
+ ext2fs->first_data_block + tsk_getu32(fs->endian,
+ ext2fs->fs->s_blocks_per_group) -
+ 1) / tsk_getu32(fs->endian,
+ ext2fs->fs->s_blocks_per_group));
}
/* Volume ID */
diff --git a/tsk/fs/ext2fs_dent.c b/tsk/fs/ext2fs_dent.c
index d370c040af5bf20a703e9533fafe7000d33e95f9..678300906f3218b54974f5dbb7a6e3e463f18807 100644
--- a/tsk/fs/ext2fs_dent.c
+++ b/tsk/fs/ext2fs_dent.c
@@ -267,15 +267,14 @@ ext2fs_dir_open_meta(TSK_FS_INFO * a_fs, TSK_FS_DIR ** a_fs_dir,
return TSK_ERR;
}
- if (tsk_verbose)
- {
+ if (tsk_verbose) {
tsk_fprintf(stderr,
"ext2fs_dir_open_meta: Processing directory %" PRIuINUM
"\n", a_addr);
#ifdef Ext4_DBG
tsk_fprintf(stderr,
"ext2fs_dir_open_meta: $OrphanFiles Inum %" PRIuINUM
- " == %" PRIuINUM ": %d\n", TSK_FS_ORPHANDIR_INUM(a_fs), a_addr,
+ " == %" PRIuINUM ": %d\n", TSK_FS_ORPHANDIR_INUM(a_fs), a_addr,
a_addr == TSK_FS_ORPHANDIR_INUM(a_fs));
#endif
}
@@ -294,14 +293,15 @@ ext2fs_dir_open_meta(TSK_FS_INFO * a_fs, TSK_FS_DIR ** a_fs_dir,
// handle the orphan directory if its contents were requested
if (a_addr == TSK_FS_ORPHANDIR_INUM(a_fs)) {
#ifdef Ext4_DBG
- tsk_fprintf(stderr,"DEBUG: Getting ready to process ORPHANS\n");
+ tsk_fprintf(stderr, "DEBUG: Getting ready to process ORPHANS\n");
#endif
return tsk_fs_dir_find_orphans(a_fs, fs_dir);
}
- else
- {
+ else {
#ifdef Ext4_DBG
- tsk_fprintf(stderr,"DEBUG: not orphan %" PRIuINUM "!=%"PRIuINUM"\n", a_addr, TSK_FS_ORPHANDIR_INUM(a_fs));
+ tsk_fprintf(stderr,
+ "DEBUG: not orphan %" PRIuINUM "!=%" PRIuINUM "\n", a_addr,
+ TSK_FS_ORPHANDIR_INUM(a_fs));
#endif
}
@@ -348,9 +348,9 @@ ext2fs_dir_open_meta(TSK_FS_INFO * a_fs, TSK_FS_DIR ** a_fs_dir,
retval_tmp =
ext2fs_dent_parse_block(ext2fs, fs_dir,
- (fs_dir->fs_file->
- meta->flags & TSK_FS_META_FLAG_UNALLOC) ? 1 : 0,
- &list_seen, dirptr, len);
+ (fs_dir->fs_file->meta->
+ flags & TSK_FS_META_FLAG_UNALLOC) ? 1 : 0, &list_seen,
+ dirptr, len);
if (retval_tmp == TSK_ERR) {
retval_final = TSK_ERR;
diff --git a/tsk/fs/ext2fs_journal.c b/tsk/fs/ext2fs_journal.c
index c2259c94c72ea91382dd5bcb4767396275cd391d..2b3b24af4fc34389ae8fbe5691a92f9d8729db04 100644
--- a/tsk/fs/ext2fs_journal.c
+++ b/tsk/fs/ext2fs_journal.c
@@ -139,8 +139,8 @@ ext2fs_jentry_walk(TSK_FS_INFO * fs, int flags,
TSK_FS_LOAD_FILE buf1;
TSK_DADDR_T i;
int b_desc_seen = 0;
- ext2fs_journ_sb * journ_sb = NULL;
- ext4fs_journ_commit_head *commit_head;
+ ext2fs_journ_sb *journ_sb = NULL;
+ ext4fs_journ_commit_head *commit_head;
// clean up any error messages that are lying around
tsk_error_reset();
@@ -328,19 +328,28 @@ ext2fs_jentry_walk(TSK_FS_INFO * fs, int flags,
tsk_printf("%" PRIuDADDR ":\tSuperblock (seq: %" PRIu32 ")\n",
i, big_tsk_getu32(head->entry_seq));
journ_sb = head;
- tsk_printf("sb version: %d\n", big_tsk_getu32(head->entry_type));
- tsk_printf("sb version: %d\n", big_tsk_getu32(journ_sb->entrytype));
- tsk_printf("sb feature_compat flags 0x%08X\n", big_tsk_getu32(journ_sb->feature_compat));
- if(big_tsk_getu32(journ_sb->feature_compat) & JBD2_FEATURE_COMPAT_CHECKSUM)
+ tsk_printf("sb version: %d\n",
+ big_tsk_getu32(head->entry_type));
+ tsk_printf("sb version: %d\n",
+ big_tsk_getu32(journ_sb->entrytype));
+ tsk_printf("sb feature_compat flags 0x%08X\n",
+ big_tsk_getu32(journ_sb->feature_compat));
+ if (big_tsk_getu32(journ_sb->
+ feature_compat) & JBD2_FEATURE_COMPAT_CHECKSUM)
tsk_printf("\tJOURNAL_CHECKSUMS\n");
- tsk_printf("sb feature_incompat flags 0x%08X\n", big_tsk_getu32(journ_sb->feature_incompat));
- if(big_tsk_getu32(journ_sb->feature_incompat) & JBD2_FEATURE_INCOMPAT_REVOKE)
+ tsk_printf("sb feature_incompat flags 0x%08X\n",
+ big_tsk_getu32(journ_sb->feature_incompat));
+ if (big_tsk_getu32(journ_sb->
+ feature_incompat) & JBD2_FEATURE_INCOMPAT_REVOKE)
tsk_printf("\tJOURNAL_REVOKE\n");
- if(big_tsk_getu32(journ_sb->feature_incompat) & JBD2_FEATURE_INCOMPAT_64BIT)
+ if (big_tsk_getu32(journ_sb->
+ feature_incompat) & JBD2_FEATURE_INCOMPAT_64BIT)
tsk_printf("\tJOURNAL_64BIT\n");
- if(big_tsk_getu32(journ_sb->feature_incompat) & JBD2_FEATURE_INCOMPAT_ASYNC_COMMIT)
+ if (big_tsk_getu32(journ_sb->
+ feature_incompat) & JBD2_FEATURE_INCOMPAT_ASYNC_COMMIT)
tsk_printf("\tJOURNAL_ASYNC_COMMIT\n");
- tsk_printf("sb feature_ro_incompat flags 0x%08X\n", big_tsk_getu32(journ_sb->feature_ro_incompat));
+ tsk_printf("sb feature_ro_incompat flags 0x%08X\n",
+ big_tsk_getu32(journ_sb->feature_ro_incompat));
}
/* Revoke Block */
@@ -354,38 +363,43 @@ ext2fs_jentry_walk(TSK_FS_INFO * fs, int flags,
/* The commit is the end of the entries */
else if (big_tsk_getu32(head->entry_type) == EXT2_J_ETYPE_COM) {
- tsk_printf("%" PRIuDADDR ":\t%sCommit Block (seq: %" PRIu32
- , i, ((i < jinfo->start_blk)
+ tsk_printf("%" PRIuDADDR ":\t%sCommit Block (seq: %" PRIu32, i,
+ ((i < jinfo->start_blk)
|| (big_tsk_getu32(head->entry_seq) <
jinfo->start_seq)) ? "Unallocated " : "Allocated ",
big_tsk_getu32(head->entry_seq));
- commit_head=head;
+ commit_head = head;
//tsk_printf("commit seq %" PRIu32 "\n", big_tsk_getu32(commit_head->c_header.entry_seq));
- if(big_tsk_getu32(journ_sb->feature_compat) & JBD2_FEATURE_COMPAT_CHECKSUM)
- {
+ if (big_tsk_getu32(journ_sb->
+ feature_compat) & JBD2_FEATURE_COMPAT_CHECKSUM) {
int chksum_type = commit_head->chksum_type;
- if(chksum_type)
- {
- tsk_printf(", checksum_type: %d", commit_head->chksum_type);
- switch(commit_head->chksum_type){
- case JBD2_CRC32_CHKSUM:
- tsk_printf("-CRC32");
- break;
- case JBD2_MD5_CHKSUM:
- tsk_printf("-MD5");
- break;
- case JBD2_SHA1_CHKSUM:
- tsk_printf("-SHA1");
- break;
- default:
- tsk_printf("-UNKOWN");
- break;
+ if (chksum_type) {
+ tsk_printf(", checksum_type: %d",
+ commit_head->chksum_type);
+ switch (commit_head->chksum_type) {
+ case JBD2_CRC32_CHKSUM:
+ tsk_printf("-CRC32");
+ break;
+ case JBD2_MD5_CHKSUM:
+ tsk_printf("-MD5");
+ break;
+ case JBD2_SHA1_CHKSUM:
+ tsk_printf("-SHA1");
+ break;
+ default:
+ tsk_printf("-UNKOWN");
+ break;
}
- tsk_printf(", checksum_size: %d", commit_head->chksum_size);
- tsk_printf(", chksum: 0x%08X", big_tsk_getu32(commit_head->chksum));
+ tsk_printf(", checksum_size: %d",
+ commit_head->chksum_size);
+ tsk_printf(", chksum: 0x%08X",
+ big_tsk_getu32(commit_head->chksum));
}
}
- tsk_printf(", sec: %llu.%u", tsk_getu64( TSK_BIG_ENDIAN,commit_head->commit_sec), NSEC_PER_SEC/10 * tsk_getu32(TSK_BIG_ENDIAN,commit_head->commit_nsec));
+ tsk_printf(", sec: %llu.%u", tsk_getu64(TSK_BIG_ENDIAN,
+ commit_head->commit_sec),
+ NSEC_PER_SEC / 10 * tsk_getu32(TSK_BIG_ENDIAN,
+ commit_head->commit_nsec));
tsk_printf(")\n");
}
diff --git a/tsk/fs/fatfs.c b/tsk/fs/fatfs.c
index ef97280e015b0f83c070a13ca93b7d6f26691343..2ec0f7b8fb2560b18a6b750bc5eb24e0e6f9d7f3 100644
--- a/tsk/fs/fatfs.c
+++ b/tsk/fs/fatfs.c
@@ -497,15 +497,16 @@ fatfs_block_walk(TSK_FS_INFO * fs, TSK_DADDR_T a_start_blk,
if ((a_flags & TSK_FS_BLOCK_WALK_FLAG_AONLY) == 0) {
cnt =
- tsk_fs_read_block(fs, addr, data_buf, fs->block_size * 8);
+ tsk_fs_read_block(fs, addr, data_buf,
+ fs->block_size * 8);
if (cnt != fs->block_size * 8) {
if (cnt >= 0) {
tsk_error_reset();
tsk_error_set_errno(TSK_ERR_FS_READ);
}
tsk_error_set_errstr2
- ("fatfs_block_walk: pre-data area block: %" PRIuDADDR,
- addr);
+ ("fatfs_block_walk: pre-data area block: %"
+ PRIuDADDR, addr);
free(data_buf);
tsk_fs_block_free(fs_block);
return 1;
@@ -626,7 +627,7 @@ fatfs_block_walk(TSK_FS_INFO * fs, TSK_DADDR_T a_start_blk,
if (a_flags & TSK_FS_BLOCK_WALK_FLAG_AONLY)
myflags |= TSK_FS_BLOCK_FLAG_AONLY;
-
+
/* The final cluster may not be full */
if (a_end_blk - addr + 1 < fatfs->csize)
read_size = (size_t) (a_end_blk - addr + 1);
@@ -641,8 +642,8 @@ fatfs_block_walk(TSK_FS_INFO * fs, TSK_DADDR_T a_start_blk,
tsk_error_reset();
tsk_error_set_errno(TSK_ERR_FS_READ);
}
- tsk_error_set_errstr2("fatfs_block_walk: block: %" PRIuDADDR,
- addr);
+ tsk_error_set_errstr2("fatfs_block_walk: block: %"
+ PRIuDADDR, addr);
free(data_buf);
tsk_fs_block_free(fs_block);
return 1;
@@ -1319,14 +1320,14 @@ static void
fatfs_close(TSK_FS_INFO * fs)
{
FATFS_INFO *fatfs = (FATFS_INFO *) fs;
-
+
fatfs_dir_buf_free(fatfs);
fs->tag = 0;
free(fatfs->sb);
tsk_deinit_lock(&fatfs->cache_lock);
tsk_deinit_lock(&fatfs->dir_lock);
-
+
tsk_fs_free(fs);
}
diff --git a/tsk/fs/ffind_lib.c b/tsk/fs/ffind_lib.c
index 5a6cdc292c653528fd430d241f76b94d0e04d43e..966609acf158fe5c811a120022a3d677ab72108e 100644
--- a/tsk/fs/ffind_lib.c
+++ b/tsk/fs/ffind_lib.c
@@ -25,7 +25,7 @@
* line tool.
*/
#include "tsk_fs_i.h"
-#include "tsk_ntfs.h" // NTFS has an optimized version of this function
+#include "tsk_ntfs.h" // NTFS has an optimized version of this function
diff --git a/tsk/fs/ffs.c b/tsk/fs/ffs.c
index 7ff675cf2a8deea29b5ce1dd2d32d4ffa78a7d30..de0ea491f4415bf5920f7552590ddd340a48e3b5 100644
--- a/tsk/fs/ffs.c
+++ b/tsk/fs/ffs.c
@@ -1241,8 +1241,8 @@ ffs_block_walk(TSK_FS_INFO * fs, TSK_DADDR_T a_start_blk,
tsk_error_reset();
tsk_error_set_errno(TSK_ERR_FS_READ);
}
- tsk_error_set_errstr2("ffs_block_walk: Block %" PRIuDADDR,
- addr);
+ tsk_error_set_errstr2("ffs_block_walk: Block %"
+ PRIuDADDR, addr);
tsk_fs_block_free(fs_block);
free(cache_blk_buf);
return 1;
@@ -1250,7 +1250,7 @@ ffs_block_walk(TSK_FS_INFO * fs, TSK_DADDR_T a_start_blk,
cache_len_f = frags;
cache_addr = addr;
}
- cache_offset = (size_t)((addr - cache_addr) * fs->block_size);
+ cache_offset = (size_t) ((addr - cache_addr) * fs->block_size);
}
if (a_flags & TSK_FS_BLOCK_WALK_FLAG_AONLY)
@@ -1258,8 +1258,7 @@ ffs_block_walk(TSK_FS_INFO * fs, TSK_DADDR_T a_start_blk,
// call the callback
tsk_fs_block_set(fs, fs_block, addr,
- myflags | TSK_FS_BLOCK_FLAG_RAW,
- &cache_blk_buf[cache_offset]);
+ myflags | TSK_FS_BLOCK_FLAG_RAW, &cache_blk_buf[cache_offset]);
retval = action(fs_block, ptr);
if (retval == TSK_WALK_STOP) {
break;
diff --git a/tsk/fs/ffs_dent.c b/tsk/fs/ffs_dent.c
index 17c3fef28d1b9d72192989c28cbf26709a4d9116..e256e58a0937428049d4deea5de55bf59a1ae420 100644
--- a/tsk/fs/ffs_dent.c
+++ b/tsk/fs/ffs_dent.c
@@ -327,8 +327,8 @@ ffs_dir_open_meta(TSK_FS_INFO * a_fs, TSK_FS_DIR ** a_fs_dir,
retval_tmp =
ffs_dent_parse_block(ffs, fs_dir,
- (fs_dir->fs_file->
- meta->flags & TSK_FS_META_FLAG_UNALLOC) ? 1 : 0,
+ (fs_dir->fs_file->meta->
+ flags & TSK_FS_META_FLAG_UNALLOC) ? 1 : 0,
dirbuf + cidx * FFS_DIRBLKSIZ, len);
if (retval_tmp == TSK_ERR) {
diff --git a/tsk/fs/fs_attr.c b/tsk/fs/fs_attr.c
index 25a03690ad220296597ee78baacda187a5be5c96..61991b613e5df9c2b58321ef049faa3b519f5050 100644
--- a/tsk/fs/fs_attr.c
+++ b/tsk/fs/fs_attr.c
@@ -794,8 +794,8 @@ tsk_fs_attr_walk_nonres(const TSK_FS_ATTR * fs_attr,
/* If the address is too large then give an error */
if (addr + len_idx > fs->last_block) {
- if (fs_attr->fs_file->meta->
- flags & TSK_FS_META_FLAG_UNALLOC)
+ if (fs_attr->fs_file->
+ meta->flags & TSK_FS_META_FLAG_UNALLOC)
tsk_error_set_errno(TSK_ERR_FS_RECOVER);
else
tsk_error_set_errno(TSK_ERR_FS_BLK_NUM);
@@ -1130,8 +1130,8 @@ tsk_fs_attr_read(const TSK_FS_ATTR * a_fs_attr, TSK_OFF_T a_offset,
fprintf(stderr,
"tsk_fs_attr_read_type: File %" PRIuINUM
" has FILLER entry, using 0s\n",
- (a_fs_attr->fs_file->meta) ? a_fs_attr->fs_file->
- meta->addr : 0);
+ (a_fs_attr->fs_file->meta) ? a_fs_attr->
+ fs_file->meta->addr : 0);
}
// we return 0s for reads past the initsize (unless they want slack space)
else if (((TSK_OFF_T) ((data_run_cur->offset +
@@ -1143,8 +1143,9 @@ tsk_fs_attr_read(const TSK_FS_ATTR * a_fs_attr, TSK_OFF_T a_offset,
fprintf(stderr,
"tsk_fs_attr_read: Returning 0s for read past end of initsize (%"
PRIuINUM ")\n", ((a_fs_attr->fs_file)
- && (a_fs_attr->fs_file->meta)) ? a_fs_attr->
- fs_file->meta->addr : 0);
+ && (a_fs_attr->fs_file->
+ meta)) ? a_fs_attr->fs_file->meta->
+ addr : 0);
}
else {
TSK_OFF_T fs_offset_b;
diff --git a/tsk/fs/fs_block.c b/tsk/fs/fs_block.c
index 476bcc68001d819d9e9cab13daf3b96c9ea6f2c9..1076e54b680890e6c73bc14cd65c401fc9bdc670 100644
--- a/tsk/fs/fs_block.c
+++ b/tsk/fs/fs_block.c
@@ -62,7 +62,8 @@ TSK_FS_BLOCK *
tsk_fs_block_get(TSK_FS_INFO * a_fs, TSK_FS_BLOCK * a_fs_block,
TSK_DADDR_T a_addr)
{
- return tsk_fs_block_get_flag(a_fs, a_fs_block, a_addr, a_fs->block_getflags(a_fs, a_addr));
+ return tsk_fs_block_get_flag(a_fs, a_fs_block, a_addr,
+ a_fs->block_getflags(a_fs, a_addr));
}
/**
@@ -127,8 +128,8 @@ tsk_fs_block_get_flag(TSK_FS_INFO * a_fs, TSK_FS_BLOCK * a_fs_block,
if ((a_fs_block->flags & TSK_FS_BLOCK_FLAG_AONLY) == 0) {
cnt =
- tsk_img_read(a_fs->img_info, a_fs->offset + offs, a_fs_block->buf,
- len);
+ tsk_img_read(a_fs->img_info, a_fs->offset + offs,
+ a_fs_block->buf, len);
if (cnt != len) {
return NULL;
}
@@ -167,7 +168,7 @@ tsk_fs_block_set(TSK_FS_INFO * a_fs, TSK_FS_BLOCK * a_fs_block,
return 1;
}
a_fs_block->fs_info = a_fs;
- if ((a_flags & TSK_FS_BLOCK_FLAG_AONLY) == 0)
+ if ((a_flags & TSK_FS_BLOCK_FLAG_AONLY) == 0)
memcpy(a_fs_block->buf, a_buf, a_fs->block_size);
a_fs_block->addr = a_addr;
a_fs_block->flags = a_flags;
diff --git a/tsk/fs/fs_dir.c b/tsk/fs/fs_dir.c
index 008ff2176f903c9bdbfb6116b40e9643f702146b..ea72de68839964c7760bc2a2921ba589a2302272 100644
--- a/tsk/fs/fs_dir.c
+++ b/tsk/fs/fs_dir.c
@@ -159,45 +159,46 @@ tsk_fs_dir_add(TSK_FS_DIR * a_fs_dir, const TSK_FS_NAME * a_fs_name)
// @@@ We could do something more effecient here too with orphan files because we do not
// need to check the contents of that directory either and this takes a lot of time on those
// large images.
- if (TSK_FS_TYPE_ISFAT(a_fs_dir->fs_info->ftype) == 0) {
- for (i = 0; i < a_fs_dir->names_used; i++) {
- if ((a_fs_name->meta_addr == a_fs_dir->names[i].meta_addr) &&
- (strcmp(a_fs_name->name, a_fs_dir->names[i].name) == 0)) {
-
- if (tsk_verbose)
- tsk_fprintf(stderr,
- "tsk_fs_dir_add: removing duplicate entry: %s (%"
- PRIuINUM ")\n", a_fs_name->name, a_fs_name->meta_addr);
-
- /* We do not check type because then we cannot detect NTFS orphan file
- * duplicates that are added as "-/r" while a similar entry exists as "r/r"
- (a_fs_name->type == a_fs_dir->names[i].type)) { */
-
- // if the one in the list is unalloc and we have an alloc, replace it
- if ((a_fs_dir->names[i].flags & TSK_FS_NAME_FLAG_UNALLOC) &&
- (a_fs_name->flags & TSK_FS_NAME_FLAG_ALLOC)) {
- fs_name_dest = &a_fs_dir->names[i];
-
- // free the memory - not the most effecient, but prevents
- // duplicate code.
- if (fs_name_dest->name) {
- free(fs_name_dest->name);
- fs_name_dest->name = NULL;
- fs_name_dest->name_size = 0;
- }
- if (fs_name_dest->shrt_name) {
- free(fs_name_dest->shrt_name);
- fs_name_dest->shrt_name = NULL;
- fs_name_dest->shrt_name_size = 0;
- }
- break;
- }
- else {
- return 0;
- }
- }
- }
- }
+ if (TSK_FS_TYPE_ISFAT(a_fs_dir->fs_info->ftype) == 0) {
+ for (i = 0; i < a_fs_dir->names_used; i++) {
+ if ((a_fs_name->meta_addr == a_fs_dir->names[i].meta_addr) &&
+ (strcmp(a_fs_name->name, a_fs_dir->names[i].name) == 0)) {
+
+ if (tsk_verbose)
+ tsk_fprintf(stderr,
+ "tsk_fs_dir_add: removing duplicate entry: %s (%"
+ PRIuINUM ")\n", a_fs_name->name,
+ a_fs_name->meta_addr);
+
+ /* We do not check type because then we cannot detect NTFS orphan file
+ * duplicates that are added as "-/r" while a similar entry exists as "r/r"
+ (a_fs_name->type == a_fs_dir->names[i].type)) { */
+
+ // if the one in the list is unalloc and we have an alloc, replace it
+ if ((a_fs_dir->names[i].flags & TSK_FS_NAME_FLAG_UNALLOC)
+ && (a_fs_name->flags & TSK_FS_NAME_FLAG_ALLOC)) {
+ fs_name_dest = &a_fs_dir->names[i];
+
+ // free the memory - not the most effecient, but prevents
+ // duplicate code.
+ if (fs_name_dest->name) {
+ free(fs_name_dest->name);
+ fs_name_dest->name = NULL;
+ fs_name_dest->name_size = 0;
+ }
+ if (fs_name_dest->shrt_name) {
+ free(fs_name_dest->shrt_name);
+ fs_name_dest->shrt_name = NULL;
+ fs_name_dest->shrt_name_size = 0;
+ }
+ break;
+ }
+ else {
+ return 0;
+ }
+ }
+ }
+ }
if (fs_name_dest == NULL) {
// make sure we got the room
diff --git a/tsk/fs/fs_name.c b/tsk/fs/fs_name.c
index 83605dc2b5328347c3a31aeadab3e2a9cd78a8aa..f692a6917d0a8cb4fe44b51a2c6f628a539d5cf2 100644
--- a/tsk/fs/fs_name.c
+++ b/tsk/fs/fs_name.c
@@ -317,7 +317,8 @@ tsk_fs_time_to_str(time_t time, char buf[128])
* @returns Pointer to buffer that was passed in.
*/
char *
-tsk_fs_time_to_str_subsecs(time_t time, unsigned int subsecs, char buf[128])
+tsk_fs_time_to_str_subsecs(time_t time, unsigned int subsecs,
+ char buf[128])
{
buf[0] = '\0';
if (time <= 0) {
@@ -325,14 +326,13 @@ tsk_fs_time_to_str_subsecs(time_t time, unsigned int subsecs, char buf[128])
}
else {
struct tm *tmTime = localtime(&time);
-
+
snprintf(buf, 64, "%.4d-%.2d-%.2d %.2d:%.2d:%.2d.%.9d (%s)",
- (int) tmTime->tm_year + 1900,
- (int) tmTime->tm_mon + 1, (int) tmTime->tm_mday,
- tmTime->tm_hour,
- (int) tmTime->tm_min, (int) tmTime->tm_sec,
- subsecs,
- tzname[(tmTime->tm_isdst == 0) ? 0 : 1]);
+ (int) tmTime->tm_year + 1900,
+ (int) tmTime->tm_mon + 1, (int) tmTime->tm_mday,
+ tmTime->tm_hour,
+ (int) tmTime->tm_min, (int) tmTime->tm_sec,
+ subsecs, tzname[(tmTime->tm_isdst == 0) ? 0 : 1]);
}
return buf;
}
@@ -445,9 +445,8 @@ tsk_fs_name_print(FILE * hFile, const TSK_FS_FILE * fs_file,
tsk_fprintf(hFile, "%s:\t",
((fs_file->meta) && (fs_file->meta->flags & TSK_FS_META_FLAG_ALLOC)
- && (fs_file->
- name->flags & TSK_FS_NAME_FLAG_UNALLOC)) ? "(realloc)" :
- "");
+ && (fs_file->name->
+ flags & TSK_FS_NAME_FLAG_UNALLOC)) ? "(realloc)" : "");
if ((print_path) && (a_path != NULL)) {
for (i = 0; i < strlen(a_path); i++) {
@@ -633,9 +632,8 @@ tsk_fs_name_print_mac(FILE * hFile, const TSK_FS_FILE * fs_file,
* allocated, then add realloc comment */
if (fs_file->name->flags & TSK_FS_NAME_FLAG_UNALLOC)
tsk_fprintf(hFile, " (deleted%s)", ((fs_file->meta)
- && (fs_file->
- meta->flags & TSK_FS_META_FLAG_ALLOC)) ? "-realloc" :
- "");
+ && (fs_file->meta->
+ flags & TSK_FS_META_FLAG_ALLOC)) ? "-realloc" : "");
/* inode */
tsk_fprintf(hFile, "|%" PRIuINUM, fs_file->name->meta_addr);
diff --git a/tsk/fs/fs_open.c b/tsk/fs/fs_open.c
index e7bde9eeb9f7d306058fbe5b2c2aeafbab0402a1..f59344332e6994c8bab7bcceadc73b84dacb240e 100644
--- a/tsk/fs/fs_open.c
+++ b/tsk/fs/fs_open.c
@@ -172,7 +172,7 @@ tsk_fs_open_img(TSK_IMG_INFO * a_img_info, TSK_OFF_T a_offset,
tsk_error_reset();
}
- if ((fs_info =
+ if ((fs_info =
yaffs2_open(a_img_info, a_offset,
TSK_FS_TYPE_YAFFS2_DETECT, 1)) != NULL) {
if (set == NULL) {
diff --git a/tsk/fs/hfs.c b/tsk/fs/hfs.c
index dc2146bbf74426c84ea87379da91690a976dd76b..29dff27dfb0ceafb2669f95dadce2dd5bf29688f 100644
--- a/tsk/fs/hfs.c
+++ b/tsk/fs/hfs.c
@@ -3795,9 +3795,8 @@ hfs_load_extended_attrs(TSK_FS_FILE * fs_file,
else {
// There is data following the compression record, as there should be.
if ((fs_attr_unc =
- tsk_fs_attrlist_getnew(fs_file->
- meta->attr,
- TSK_FS_ATTR_RES)) == NULL) {
+ tsk_fs_attrlist_getnew(fs_file->meta->
+ attr, TSK_FS_ATTR_RES)) == NULL) {
error_returned
(" - hfs_load_extended_attrs, FS_ATTR for uncompressed data");
free(nodeData);
@@ -4829,7 +4828,8 @@ hfs_block_walk(TSK_FS_INFO * fs, TSK_DADDR_T start_blk,
if (flags & TSK_FS_BLOCK_WALK_FLAG_AONLY)
myflags |= TSK_FS_BLOCK_FLAG_AONLY;
- if (tsk_fs_block_get_flag(fs, fs_block, addr, (TSK_FS_BLOCK_FLAG_ENUM)myflags) == NULL) {
+ if (tsk_fs_block_get_flag(fs, fs_block, addr,
+ (TSK_FS_BLOCK_FLAG_ENUM) myflags) == NULL) {
tsk_fs_block_free(fs_block);
return 1;
}
diff --git a/tsk/fs/iso9660.c b/tsk/fs/iso9660.c
index 1454be567d1177bcb32770d9b19f43c1e17a0104..5fa9e313c74084d597ae29449cc574c6221dec7d 100644
--- a/tsk/fs/iso9660.c
+++ b/tsk/fs/iso9660.c
@@ -388,8 +388,7 @@ iso9660_load_inodes_dir(TSK_FS_INFO * fs, TSK_OFF_T a_offs, int count,
if (tsk_verbose)
tsk_fprintf(stderr,
"iso9660_load_inodes_dir: offs: %" PRIuOFF
- " count: %d ctype: %d fn: %s\n",
- a_offs, count, ctype, a_fn);
+ " count: %d ctype: %d fn: %s\n", a_offs, count, ctype, a_fn);
// cycle through each sector -- entries will not cross them
for (i = 0; i < s_cnt; i++) {
@@ -497,8 +496,8 @@ iso9660_load_inodes_dir(TSK_FS_INFO * fs, TSK_OFF_T a_offs, int count,
(const UTF16 **) &name16,
(UTF16 *) & buf[b_offs + sizeof(iso9660_dentry) +
dentry->fi_len], &name8,
- (UTF8 *) ((uintptr_t) & in_node->
- inode.fn[ISO9660_MAXNAMLEN_STD]),
+ (UTF8 *) ((uintptr_t) & in_node->inode.
+ fn[ISO9660_MAXNAMLEN_STD]),
TSKlenientConversion);
if (retVal != TSKconversionOK) {
if (tsk_verbose)
@@ -1122,9 +1121,8 @@ iso9660_inode_walk(TSK_FS_INFO * fs, TSK_INUM_T start, TSK_INUM_T last,
if (tsk_verbose)
tsk_fprintf(stderr, "iso9660_inode_walk: "
" start: %" PRIuINUM " last: %" PRIuINUM " flags: %d"
- " action: %"PRIu64" ptr: %"PRIu64"\n",
- start, last, flags, (uint64_t) action,
- (uint64_t) ptr);
+ " action: %" PRIu64 " ptr: %" PRIu64 "\n",
+ start, last, flags, (uint64_t) action, (uint64_t) ptr);
myflags = TSK_FS_META_FLAG_ALLOC;
@@ -1331,9 +1329,8 @@ iso9660_block_walk(TSK_FS_INFO * fs, TSK_DADDR_T start, TSK_DADDR_T last,
if (tsk_verbose)
tsk_fprintf(stderr, "iso9660_block_walk: "
" start: %" PRIuDADDR " last: %" PRIuDADDR " flags: %d"
- " action: %"PRIu64" ptr: %"PRIu64"\n",
- start, last, flags, (uint64_t) action,
- (uint64_t) ptr);
+ " action: %" PRIu64 " ptr: %" PRIu64 "\n",
+ start, last, flags, (uint64_t) action, (uint64_t) ptr);
/*
* Sanity checks.
@@ -1390,7 +1387,7 @@ iso9660_block_walk(TSK_FS_INFO * fs, TSK_DADDR_T start, TSK_DADDR_T last,
if (flags & TSK_FS_BLOCK_WALK_FLAG_AONLY)
myflags |= TSK_FS_BLOCK_FLAG_AONLY;
-
+
if (tsk_fs_block_get_flag(fs, fs_block, addr, myflags) == NULL) {
tsk_error_set_errstr2("iso_block_walk");
tsk_fs_block_free(fs_block);
@@ -1785,8 +1782,8 @@ make_unix_perm(TSK_FS_INFO * fs, iso9660_dentry * dd,
iso9660_inode * dinode, char *perm)
{
if (tsk_verbose)
- tsk_fprintf(stderr, "make_unix_perm: fs: %"PRIu64
- " dd: %"PRIu64"\n", (uint64_t) fs, (uint64_t) dd);
+ tsk_fprintf(stderr, "make_unix_perm: fs: %" PRIu64
+ " dd: %" PRIu64 "\n", (uint64_t) fs, (uint64_t) dd);
memset(perm, '-', 10);
perm[10] = '\0';
@@ -2392,7 +2389,7 @@ iso9660_open(TSK_IMG_INFO * img_info, TSK_OFF_T offset,
}
if (tsk_verbose) {
- tsk_fprintf(stderr, "iso9660_open img_info: %"PRIu64
+ tsk_fprintf(stderr, "iso9660_open img_info: %" PRIu64
" ftype: %" PRIu8 " test: %" PRIu8 "\n", (uint64_t) img_info,
ftype, test);
}
@@ -2475,8 +2472,7 @@ iso9660_open(TSK_IMG_INFO * img_info, TSK_OFF_T offset,
fs->tag = 0;
iso9660_close(fs);
if (tsk_verbose)
- fprintf(stderr,
- "iso9660_open: Block size is 0\n");
+ fprintf(stderr, "iso9660_open: Block size is 0\n");
if (test)
return NULL;
else {
diff --git a/tsk/fs/nofs_misc.c b/tsk/fs/nofs_misc.c
index 7b74afee38cd3fb28810eab2fa54eedfd56bfe4a..ebd2e0a59064805780de6c26ebc9fc71fd5389d1 100644
--- a/tsk/fs/nofs_misc.c
+++ b/tsk/fs/nofs_misc.c
@@ -57,8 +57,8 @@ tsk_fs_nofs_make_data_run(TSK_FS_FILE * a_fs_file)
tsk_error_reset();
tsk_error_set_errno(TSK_ERR_FS_UNSUPFUNC);
tsk_error_set_errstr("Illegal analysis method for %s data ",
- (a_fs_file->fs_info) ? tsk_fs_type_toname(a_fs_file->fs_info->
- ftype) : "");
+ (a_fs_file->fs_info) ? tsk_fs_type_toname(a_fs_file->
+ fs_info->ftype) : "");
return 1;
}
diff --git a/tsk/fs/ntfs.c b/tsk/fs/ntfs.c
index 23baad47d4daff81853919a5dd601da81539fad0..5563704c91e3a88d9f7ed41b59553c7f53d776b8 100755
--- a/tsk/fs/ntfs.c
+++ b/tsk/fs/ntfs.c
@@ -1229,8 +1229,8 @@ ntfs_attr_walk_special(const TSK_FS_ATTR * fs_attr,
if (fs_attr_run->addr != 0) {
tsk_error_reset();
- if (fs_attr->fs_file->
- meta->flags & TSK_FS_META_FLAG_UNALLOC)
+ if (fs_attr->fs_file->meta->
+ flags & TSK_FS_META_FLAG_UNALLOC)
tsk_error_set_errno(TSK_ERR_FS_RECOVER);
else
tsk_error_set_errno(TSK_ERR_FS_GENFS);
@@ -1240,9 +1240,9 @@ ntfs_attr_walk_special(const TSK_FS_ATTR * fs_attr,
" id: %d Meta: %" PRIuINUM " Status: %s",
fs_attr_run->len, fs_attr_run->addr, fs_attr->type,
fs_attr->id, fs_attr->fs_file->meta->addr,
- (fs_attr->fs_file->
- meta->flags & TSK_FS_META_FLAG_ALLOC) ?
- "Allocated" : "Deleted");
+ (fs_attr->fs_file->meta->
+ flags & TSK_FS_META_FLAG_ALLOC) ? "Allocated" :
+ "Deleted");
free(comp_unit);
ntfs_uncompress_done(&comp);
return 1;
@@ -1261,8 +1261,8 @@ ntfs_attr_walk_special(const TSK_FS_ATTR * fs_attr,
if (addr > fs->last_block) {
tsk_error_reset();
- if (fs_attr->fs_file->
- meta->flags & TSK_FS_META_FLAG_UNALLOC)
+ if (fs_attr->fs_file->meta->
+ flags & TSK_FS_META_FLAG_UNALLOC)
tsk_error_set_errno(TSK_ERR_FS_RECOVER);
else
tsk_error_set_errno(TSK_ERR_FS_BLK_NUM);
@@ -1270,9 +1270,9 @@ ntfs_attr_walk_special(const TSK_FS_ATTR * fs_attr,
("ntfs_attr_walk_special: Invalid address in run (too large): %"
PRIuDADDR " Meta: %" PRIuINUM " Status: %s", addr,
fs_attr->fs_file->meta->addr,
- (fs_attr->fs_file->
- meta->flags & TSK_FS_META_FLAG_ALLOC) ?
- "Allocated" : "Deleted");
+ (fs_attr->fs_file->meta->
+ flags & TSK_FS_META_FLAG_ALLOC) ? "Allocated" :
+ "Deleted");
free(comp_unit);
ntfs_uncompress_done(&comp);
@@ -1295,8 +1295,8 @@ ntfs_attr_walk_special(const TSK_FS_ATTR * fs_attr,
PRIu32 " id: %d Status: %s",
fs_attr->fs_file->meta->addr, fs_attr->type,
fs_attr->id,
- (fs_attr->fs_file->
- meta->flags & TSK_FS_META_FLAG_ALLOC) ?
+ (fs_attr->fs_file->meta->
+ flags & TSK_FS_META_FLAG_ALLOC) ?
"Allocated" : "Deleted");
free(comp_unit);
ntfs_uncompress_done(&comp);
@@ -1313,8 +1313,8 @@ ntfs_attr_walk_special(const TSK_FS_ATTR * fs_attr,
TSK_FS_BLOCK_FLAG_COMP;
retval = is_clustalloc(ntfs, comp_unit[i]);
if (retval == -1) {
- if (fs_attr->fs_file->
- meta->flags & TSK_FS_META_FLAG_UNALLOC)
+ if (fs_attr->fs_file->meta->
+ flags & TSK_FS_META_FLAG_UNALLOC)
tsk_error_set_errno(TSK_ERR_FS_RECOVER);
free(comp_unit);
ntfs_uncompress_done(&comp);
@@ -1342,8 +1342,8 @@ ntfs_attr_walk_special(const TSK_FS_ATTR * fs_attr,
i * fs->block_size + read_len,
comp.uncomp_idx,
fs_attr->fs_file->meta->addr,
- (fs_attr->fs_file->
- meta->flags & TSK_FS_META_FLAG_ALLOC) ?
+ (fs_attr->fs_file->meta->
+ flags & TSK_FS_META_FLAG_ALLOC) ?
"Allocated" : "Deleted");
free(comp_unit);
ntfs_uncompress_done(&comp);
@@ -1535,8 +1535,8 @@ ntfs_file_read_special(const TSK_FS_ATTR * a_fs_attr,
PRIu32 " id: %d Status: %s",
a_fs_attr->fs_file->meta->addr,
a_fs_attr->type, a_fs_attr->id,
- (a_fs_attr->fs_file->
- meta->flags & TSK_FS_META_FLAG_ALLOC) ?
+ (a_fs_attr->fs_file->meta->
+ flags & TSK_FS_META_FLAG_ALLOC) ?
"Allocated" : "Deleted");
free(comp_unit);
ntfs_uncompress_done(&comp);
@@ -2996,7 +2996,7 @@ ntfs_sds_to_str(TSK_FS_INFO * a_fs, const ntfs_attr_sds * a_sds,
//tsk_fprintf(stderr, "Sub-Authority Count: %i\n", sid->sub_auth_count);
authority = 0;
for (i = 0; i < 6; i++)
- authority += (uint64_t) sid->ident_auth[i] << ((5-i)*8);
+ authority += (uint64_t) sid->ident_auth[i] << ((5 - i) * 8);
//tsk_fprintf(stderr, "NT Authority: %" PRIu64 "\n", authority);
@@ -3012,8 +3012,7 @@ ntfs_sds_to_str(TSK_FS_INFO * a_fs, const ntfs_attr_sds * a_sds,
sid_str_offset = sid_str + len;
for (i = 0; i < sid->sub_auth_count; i++) {
- len =
- sprintf(sid_str_offset, "-%" PRIu32, sid->sub_auth[i]);
+ len = sprintf(sid_str_offset, "-%" PRIu32, sid->sub_auth[i]);
sid_str_offset += len;
}
*a_sidstr = sid_str;
@@ -3076,8 +3075,8 @@ ntfs_get_sds(TSK_FS_INFO * fs, uint32_t secid)
// versions of NTFS.
for (i = 0; i < ntfs->sii_data.used; i++) {
if (tsk_getu32(fs->endian,
- ((ntfs_attr_sii *) (ntfs->sii_data.
- buffer))[i].key_sec_id) == secid) {
+ ((ntfs_attr_sii *) (ntfs->sii_data.buffer))[i].
+ key_sec_id) == secid) {
sii = &((ntfs_attr_sii *) (ntfs->sii_data.buffer))[i];
break;
}
@@ -3130,17 +3129,18 @@ ntfs_get_sds(TSK_FS_INFO * fs, uint32_t secid)
}
else {
if (tsk_verbose)
- tsk_fprintf(stderr, "ntfs_get_sds: entry found was for wrong Security ID (%"PRIu32" vs %"PRIu32")\n",
- sds_secid, sii_secid);
+ tsk_fprintf(stderr,
+ "ntfs_get_sds: entry found was for wrong Security ID (%"
+ PRIu32 " vs %" PRIu32 ")\n", sds_secid, sii_secid);
// if (sii_secid != 0) {
-
- // There is obviously a mismatch between the information in the SII entry and that in the SDS entry.
- // After looking at these mismatches, it appears there is not a pattern. Perhaps some entries have been reused.
- //printf("\nsecid %d hash %x offset %I64x size %x\n", sii_secid, sii_sechash, sii_sds_file_off, sii_sds_ent_size);
- //printf("secid %d hash %x offset %I64x size %x\n", sds_secid, sds_sechash, sds_file_off, sds_ent_size);
- // }
+ // There is obviously a mismatch between the information in the SII entry and that in the SDS entry.
+ // After looking at these mismatches, it appears there is not a pattern. Perhaps some entries have been reused.
+
+ //printf("\nsecid %d hash %x offset %I64x size %x\n", sii_secid, sii_sechash, sii_sds_file_off, sii_sds_ent_size);
+ //printf("secid %d hash %x offset %I64x size %x\n", sds_secid, sds_sechash, sds_file_off, sds_ent_size);
+ // }
}
tsk_error_reset();
@@ -3413,7 +3413,8 @@ ntfs_load_secure(NTFS_INFO * ntfs)
// allocate the structure for the processed version of the data
ntfs->sii_data.used = 0; // use this to count the number of $SII entries
- if ((ntfs->sii_data.buffer = (char *)tsk_malloc(sii_buffer.size)) == NULL) {
+ if ((ntfs->sii_data.buffer =
+ (char *) tsk_malloc(sii_buffer.size)) == NULL) {
free(sii_buffer.buffer);
tsk_fs_file_close(secure);
return 1;
@@ -3425,12 +3426,12 @@ ntfs_load_secure(NTFS_INFO * ntfs)
free(sii_buffer.buffer);
- /* Now we copy $SDS into NTFS_INFO. We do not do any processing in this step.*/
+ /* Now we copy $SDS into NTFS_INFO. We do not do any processing in this step. */
// Allocate space for the entire $SDS stream with all the security
// descriptors. We should be able to use the $SII offset to index
// into the $SDS stream.
- ntfs->sds_data.size = (size_t)fs_attr_sds->size;
+ ntfs->sds_data.size = (size_t) fs_attr_sds->size;
// arbitrary check because we had problems before with alloc too much memory
if (ntfs->sds_data.size > 64000000) {
if (tsk_verbose)
@@ -3446,7 +3447,8 @@ ntfs_load_secure(NTFS_INFO * ntfs)
return 0;
}
ntfs->sds_data.used = 0;
- if ((ntfs->sds_data.buffer = (char *)tsk_malloc(ntfs->sds_data.size)) == NULL) {
+ if ((ntfs->sds_data.buffer =
+ (char *) tsk_malloc(ntfs->sds_data.size)) == NULL) {
free(ntfs->sii_data.buffer);
ntfs->sii_data.buffer = NULL;
ntfs->sii_data.used = 0;
@@ -3458,7 +3460,8 @@ ntfs_load_secure(NTFS_INFO * ntfs)
// Read in the raw $SDS ($DATA) stream.
cnt =
tsk_fs_attr_read(fs_attr_sds, 0,
- ntfs->sds_data.buffer, ntfs->sds_data.size, TSK_FS_FILE_READ_FLAG_NONE);
+ ntfs->sds_data.buffer, ntfs->sds_data.size,
+ TSK_FS_FILE_READ_FLAG_NONE);
if (cnt != ntfs->sds_data.size) {
if (tsk_verbose)
tsk_fprintf(stderr,
@@ -3596,7 +3599,8 @@ ntfs_block_walk(TSK_FS_INFO * fs,
if (a_flags & TSK_FS_BLOCK_WALK_FLAG_AONLY)
myflags |= TSK_FS_BLOCK_FLAG_AONLY;
- if (tsk_fs_block_get_flag(fs, fs_block, addr, (TSK_FS_BLOCK_FLAG_ENUM)myflags) == NULL) {
+ if (tsk_fs_block_get_flag(fs, fs_block, addr,
+ (TSK_FS_BLOCK_FLAG_ENUM) myflags) == NULL) {
tsk_error_set_errstr2
("ntfs_block_walk: Error reading block at %" PRIuDADDR,
addr);
@@ -4164,7 +4168,7 @@ ntfs_istat(TSK_FS_INFO * fs, FILE * hFile,
tsk_fprintf(hFile, "\n");
tsk_fprintf(hFile, "Owner ID: %" PRIu32 "\n",
tsk_getu32(fs->endian, si->own_id));
-
+
#if TSK_USE_SID
ntfs_file_get_sidstr(fs_file, &sid_str);
diff --git a/tsk/fs/tsk_ext2fs.h b/tsk/fs/tsk_ext2fs.h
index 6e9765fb8545c7b0a88691bdc7a7aab7c28537be..b9b622807f5d6b81e634f1221209bcd0836879c7 100644
--- a/tsk/fs/tsk_ext2fs.h
+++ b/tsk/fs/tsk_ext2fs.h
@@ -134,13 +134,13 @@ extern "C" {
uint8_t s_uuid[16]; /* u8[16] */
char s_volume_name[16];
char s_last_mounted[64];
- uint8_t s_algorithm_usage_bitmap[4]; /* u32 */
+ uint8_t s_algorithm_usage_bitmap[4]; /* u32 */
uint8_t s_prealloc_blocks; /* u8 */
uint8_t s_prealloc_dir_blocks; /* u8 */
- union pad_or_gdt{
- uint8_t s_padding1[2]; /* u16 */
- uint8_t s_reserved_gdt_blocks[2]; /*u16*/
- }pad_or_gdt;
+ union pad_or_gdt {
+ uint8_t s_padding1[2]; /* u16 */
+ uint8_t s_reserved_gdt_blocks[2]; /*u16 */
+ } pad_or_gdt;
/* Valid if EXT2_FEATURE_COMPAT_HAS_JOURNAL */
uint8_t s_journal_uuid[16]; /* u8[16] */
uint8_t s_journal_inum[4]; /* u32 */
@@ -149,21 +149,21 @@ extern "C" {
uint8_t s_hash_seed[16]; /* u32[4] */
uint8_t s_def_hash_version; /* u8 */
uint8_t s_jnl_backup_type; /* u8 */
- uint8_t s_desc_size[2]; /* u16 */
- uint8_t s_default_mount_opts[4]; /* u32 */
+ uint8_t s_desc_size[2]; /* u16 */
+ uint8_t s_default_mount_opts[4]; /* u32 */
uint8_t s_first_meta_bg[4]; /* u32 */
- uint8_t s_mkfs_time[4]; /* u32 */
+ uint8_t s_mkfs_time[4]; /* u32 */
uint8_t s_jnl_blocks[17 * 4]; /* u32[17] */
/* Valid if EXT4_FEATURE_INCOMPAT_64BIT*/
uint8_t s_blocks_count_hi[4]; /* u32 */
uint8_t s_r_blocks_count_hi[4]; /* u32 */
- uint8_t s_free_blocks_count_hi[4]; /* u32 */
+ uint8_t s_free_blocks_count_hi[4]; /* u32 */
uint8_t s_min_extra_isize[2]; /* u16 */
uint8_t s_want_extra_isize[2]; /* u16 */
- uint8_t s_flags[4]; /* u32 */
+ uint8_t s_flags[4]; /* u32 */
uint8_t s_raid_stride[2]; /* u16 */
uint8_t s_mmp_interval[2]; /* u16 */
- uint8_t s_mmp_block[8]; /* u64 */
+ uint8_t s_mmp_block[8]; /* u64 */
uint8_t s_raid_stripe_width[4]; /* u32 */
uint8_t s_log_groups_per_flex; /* u8 */
uint8_t s_reserved_char_pad; /* u8 */
@@ -171,7 +171,7 @@ extern "C" {
uint8_t s_kbytes_written[8]; /* u64 */
uint8_t s_snapshot_inum[4]; /* u32 */
uint8_t s_snapshot_id[4]; /* u32 */
- uint8_t s_snapshot_r_blocks_count[8]; /* u64 */
+ uint8_t s_snapshot_r_blocks_count[8]; /* u64 */
uint8_t s_snapshot_list[4]; /* u32 */
uint8_t s_error_count[4]; /* u32 */
uint8_t s_first_error_time[4]; /* u32 */
@@ -188,7 +188,7 @@ extern "C" {
uint8_t s_usr_quota_inum[4]; /* u32 */
uint8_t s_grp_quota_inum[4]; /* u32 */
uint8_t s_overhead_clusters[4]; /* u32 */
- uint8_t s_padding[ 109 * 4];
+ uint8_t s_padding[109 * 4];
} ext2fs_sb;
/* File system State Values */
@@ -231,8 +231,8 @@ extern "C" {
#define EXT2FS_FEATURE_INCOMPAT_FLEX_BG 0x0200
#define EXT2FS_FEATURE_INCOMPAT_EA_INODE 0x0400
#define EXT2FS_FEATURE_INCOMPAT_DIRDATA 0x1000
-#define EXT4FS_FEATURE_INCOMPAT_INLINEDATA 0x2000 /* data in inode */
-#define EXT4FS_FEATURE_INCOMPAT_LARGEDIR 0x4000 /* >2GB or 3-lvl htree */
+#define EXT4FS_FEATURE_INCOMPAT_INLINEDATA 0x2000 /* data in inode */
+#define EXT4FS_FEATURE_INCOMPAT_LARGEDIR 0x4000 /* >2GB or 3-lvl htree */
#define EXT2FS_HAS_RO_COMPAT_FEATURE(fs,sb,mask)\
((tsk_getu32(fs->endian,sb->s_feature_ro_compat) & mask) != 0)
@@ -252,7 +252,7 @@ extern "C" {
/*
* Group Descriptor
*/
- typedef struct ext2fs_gd{
+ typedef struct ext2fs_gd {
uint8_t bg_block_bitmap[4]; /* u32: block of blocks bitmap */
uint8_t bg_inode_bitmap[4]; /* u32: block of inodes bitmap */
uint8_t bg_inode_table[4]; /* u32: block of inodes table */
@@ -262,33 +262,33 @@ extern "C" {
uint8_t f1[14];
} ext2fs_gd;
-#define EXT4_BG_INODE_UNINIT 0x0001 /* Inode table/bitmap not in use */
-#define EXT4_BG_BLOCK_UNINIT 0x0002 /* Block bitmap not in use */
-#define EXT4_BG_INODE_ZEROED 0x0004 /* On-disk itable initialized to zero */
+#define EXT4_BG_INODE_UNINIT 0x0001 /* Inode table/bitmap not in use */
+#define EXT4_BG_BLOCK_UNINIT 0x0002 /* Block bitmap not in use */
+#define EXT4_BG_INODE_ZEROED 0x0004 /* On-disk itable initialized to zero */
#define EXT4BG_HAS_FLAG(fs,gd,flag)\
((tsk_getu16(fs->endian,gd->bg_flags) & flag) != 0)
- typedef struct ext4fs_gd{
- uint8_t bg_block_bitmap_lo[4]; /* u32 */
- uint8_t bg_inode_bitmap_lo[4]; /* u32 */
- uint8_t bg_inode_table_lo[4]; /* u32 */
- uint8_t bg_free_blocks_count_lo[2]; /* u16 */
- uint8_t bg_free_inodes_count_lo[2]; /* u16 */
- uint8_t bg_used_dirs_count_lo[2]; /* u16 */
- uint8_t bg_flags[2]; /* u16 */
- uint8_t bg_reserved[4*2]; /* u32 */
- uint8_t bg_itable_unused_lo[2]; /* u16 */
- uint8_t bg_checksum[2]; /* u16 */
- uint8_t bg_block_bitmap_hi[4]; /* u32 */
- uint8_t bg_inode_bitmap_hi[4]; /* u32 */
- uint8_t bg_inode_table_hi[4]; /* u32 */
- uint8_t bg_free_blocks_count_hi[2]; /* u16 */
- uint8_t bg_free_inodes_count_hi[2]; /* u16 */
- uint8_t bg_used_dirs_count_hi[2]; /* u16 */
- uint8_t bg_itable_unused_hi[2]; /* u16 */
- uint8_t bg_reserved2[4*3]; /* u32 */
- }ext4fs_gd;
+ typedef struct ext4fs_gd {
+ uint8_t bg_block_bitmap_lo[4]; /* u32 */
+ uint8_t bg_inode_bitmap_lo[4]; /* u32 */
+ uint8_t bg_inode_table_lo[4]; /* u32 */
+ uint8_t bg_free_blocks_count_lo[2]; /* u16 */
+ uint8_t bg_free_inodes_count_lo[2]; /* u16 */
+ uint8_t bg_used_dirs_count_lo[2]; /* u16 */
+ uint8_t bg_flags[2]; /* u16 */
+ uint8_t bg_reserved[4 * 2]; /* u32 */
+ uint8_t bg_itable_unused_lo[2]; /* u16 */
+ uint8_t bg_checksum[2]; /* u16 */
+ uint8_t bg_block_bitmap_hi[4]; /* u32 */
+ uint8_t bg_inode_bitmap_hi[4]; /* u32 */
+ uint8_t bg_inode_table_hi[4]; /* u32 */
+ uint8_t bg_free_blocks_count_hi[2]; /* u16 */
+ uint8_t bg_free_inodes_count_hi[2]; /* u16 */
+ uint8_t bg_used_dirs_count_hi[2]; /* u16 */
+ uint8_t bg_itable_unused_hi[2]; /* u16 */
+ uint8_t bg_reserved2[4 * 3]; /* u32 */
+ } ext4fs_gd;
/* data address to group number */
@@ -330,39 +330,39 @@ extern "C" {
uint8_t i_frag;
uint8_t i_fsize;
uint8_t f1[2];
- uint8_t i_uid_high[2]; /* u16 */
- uint8_t i_gid_high[2]; /* u16 */
- uint8_t f7[4]; /* u32 */
- uint8_t i_extra_isize[2]; /* u16 */
- uint8_t i_pad1[2]; /* u16 */
- uint8_t i_ctime_extra[4]; /* u32 */
- uint8_t i_mtime_extra[4]; /* u32 */
- uint8_t i_atime_extra[4]; /* u32 */
- uint8_t i_crtime[4]; /* u32 */
- uint8_t i_crtime_extra[4]; /* u32 */
- uint8_t i_version_hi[4]; /* u32 */
+ uint8_t i_uid_high[2]; /* u16 */
+ uint8_t i_gid_high[2]; /* u16 */
+ uint8_t f7[4]; /* u32 */
+ uint8_t i_extra_isize[2]; /* u16 */
+ uint8_t i_pad1[2]; /* u16 */
+ uint8_t i_ctime_extra[4]; /* u32 */
+ uint8_t i_mtime_extra[4]; /* u32 */
+ uint8_t i_atime_extra[4]; /* u32 */
+ uint8_t i_crtime[4]; /* u32 */
+ uint8_t i_crtime_extra[4]; /* u32 */
+ uint8_t i_version_hi[4]; /* u32 */
} ext2fs_inode;
typedef struct ext2fs_extent {
- uint8_t ee_block[4]; /* u32 */
- uint8_t ee_len[2]; /* u16 */
- uint8_t ee_start_hi[2]; /* u16 */
- uint8_t ee_start_lo[4]; /* u32 */
+ uint8_t ee_block[4]; /* u32 */
+ uint8_t ee_len[2]; /* u16 */
+ uint8_t ee_start_hi[2]; /* u16 */
+ uint8_t ee_start_lo[4]; /* u32 */
} ext2fs_extent;
typedef struct ext2fs_extent_idx {
- uint8_t ei_block[4]; /* u32 */
- uint8_t ei_leaf_lo[4]; /* u32 */
- uint8_t ei_leaf_hi[2]; /* u16 */
- uint8_t ei_unused[2]; /* u16 */
+ uint8_t ei_block[4]; /* u32 */
+ uint8_t ei_leaf_lo[4]; /* u32 */
+ uint8_t ei_leaf_hi[2]; /* u16 */
+ uint8_t ei_unused[2]; /* u16 */
} ext2fs_extent_idx;
typedef struct ext2fs_extent_header {
- uint8_t eh_magic[2]; /* u16 */
- uint8_t eh_entries[2]; /* u16 */
- uint8_t eh_max[2]; /* u16 */
- uint8_t eh_depth[2]; /* u16 */
- uint8_t eh_generation[4]; /* u32 */
+ uint8_t eh_magic[2]; /* u16 */
+ uint8_t eh_entries[2]; /* u16 */
+ uint8_t eh_max[2]; /* u16 */
+ uint8_t eh_depth[2]; /* u16 */
+ uint8_t eh_generation[4]; /* u32 */
} ext2fs_extent_header;
/* MODE */
@@ -398,22 +398,22 @@ extern "C" {
#define EXT2_IN_NODUMP 0x00000040 /* do not dump file */
#define EXT2_IN_NOA 0x00000080 /* do not update atime */
#define EXT2_IN_DIRTY 0x00000100
-#define EXT2_IN_COMPRBLK 0x00000200 /* One or more compressed clusters */
-#define EXT2_IN_NOCOMPR 0x00000400 /* Don't compress */
-#define EXT2_IN_ECOMPR 0x00000800 /* Compression error */
-#define EXT2_IN_INDEX 0x00001000 /* hash-indexed directory */
-#define EXT2_IN_IMAGIC 0x00002000 /* AFS directory */
-#define EXT2_IN_JOURNAL_DATA 0x00004000 /* file data should be journaled */
-#define EXT2_IN_NOTAIL 0x00008000 /* file tail should not be merged */
-#define EXT2_IN_DIRSYNC 0x00010000 /* dirsync behaviour (directories only) */
-#define EXT2_IN_TOPDIR 0x00020000 /* Top of directory hierarchies*/
-#define EXT2_IN_HUGE_FILE 0x00040000 /* Set to each huge file */
-#define EXT2_IN_EXTENTS 0x00080000 /* Inode uses extents */
-#define EXT2_IN_EA_INODE 0x00200000 /* Inode used for large EA */
-#define EXT2_IN_EOFBLOCKS 0x00400000 /* Blocks allocated beyond EOF */
-#define EXT2_IN_RESERVED 0x80000000 /* reserved for ext4 lib */
-#define EXT2_IN_USER_VISIBLE 0x004BDFFF /* User visible flags */
-#define EXT2_IN_USER_MODIFIABLE 0x004B80FF /* User modifiable flags */
+#define EXT2_IN_COMPRBLK 0x00000200 /* One or more compressed clusters */
+#define EXT2_IN_NOCOMPR 0x00000400 /* Don't compress */
+#define EXT2_IN_ECOMPR 0x00000800 /* Compression error */
+#define EXT2_IN_INDEX 0x00001000 /* hash-indexed directory */
+#define EXT2_IN_IMAGIC 0x00002000 /* AFS directory */
+#define EXT2_IN_JOURNAL_DATA 0x00004000 /* file data should be journaled */
+#define EXT2_IN_NOTAIL 0x00008000 /* file tail should not be merged */
+#define EXT2_IN_DIRSYNC 0x00010000 /* dirsync behaviour (directories only) */
+#define EXT2_IN_TOPDIR 0x00020000 /* Top of directory hierarchies */
+#define EXT2_IN_HUGE_FILE 0x00040000 /* Set to each huge file */
+#define EXT2_IN_EXTENTS 0x00080000 /* Inode uses extents */
+#define EXT2_IN_EA_INODE 0x00200000 /* Inode used for large EA */
+#define EXT2_IN_EOFBLOCKS 0x00400000 /* Blocks allocated beyond EOF */
+#define EXT2_IN_RESERVED 0x80000000 /* reserved for ext4 lib */
+#define EXT2_IN_USER_VISIBLE 0x004BDFFF /* User visible flags */
+#define EXT2_IN_USER_MODIFIABLE 0x004B80FF /* User modifiable flags */
/*
@@ -598,7 +598,7 @@ extern "C" {
uint8_t chksum_type;
uint8_t chksum_size;
uint8_t padding[2];
- uint8_t chksum[4*JBD2_CHECKSUM_BYTES];
+ uint8_t chksum[4 * JBD2_CHECKSUM_BYTES];
uint8_t commit_sec[8];
uint8_t commit_nsec[4];
} ext4fs_journ_commit_head;
diff --git a/tsk/fs/tsk_fatfs.h b/tsk/fs/tsk_fatfs.h
index fad968f8add4b0683aebf1561892e96ea9259d37..de6c0a3e378785b28d2d3332a263256d789e8a5e 100644
--- a/tsk/fs/tsk_fatfs.h
+++ b/tsk/fs/tsk_fatfs.h
@@ -345,7 +345,7 @@ extern "C" {
tsk_lock_t dir_lock; //< Lock that protects inum2par.
void *inum2par; //< Maps subfolder metadata address to parent folder metadata addresses.
- } FATFS_INFO;
+ } FATFS_INFO;
extern int8_t fatfs_is_sectalloc(FATFS_INFO *, TSK_DADDR_T);
@@ -376,7 +376,7 @@ extern "C" {
extern uint8_t fatfs_dir_buf_add(FATFS_INFO * fatfs,
TSK_INUM_T par_inum, TSK_INUM_T dir_inum);
extern void fatfs_cleanup_ascii(char *);
- extern void fatfs_dir_buf_free(FATFS_INFO *fatfs);
+ extern void fatfs_dir_buf_free(FATFS_INFO * fatfs);
#ifdef __cplusplus
diff --git a/tsk/fs/tsk_fs.h b/tsk/fs/tsk_fs.h
index bd37e56d962b6911b9be1e135e1595ed4df7bce3..2668a8d2a24d242c66b321c8afe8e19b88659a99 100644
--- a/tsk/fs/tsk_fs.h
+++ b/tsk/fs/tsk_fs.h
@@ -74,8 +74,8 @@ extern "C" {
TSK_FS_BLOCK_FLAG_RAW = 0x0020, ///< The data has been read raw from the disk (and not COMP or SPARSE)
TSK_FS_BLOCK_FLAG_SPARSE = 0x0040, ///< The data passed in the file_walk calback was stored as sparse (all zeros) (and not RAW or COMP)
TSK_FS_BLOCK_FLAG_COMP = 0x0080, ///< The data passed in the file_walk callback was stored in a compressed form (and not RAW or SPARSE)
- TSK_FS_BLOCK_FLAG_RES = 0x0100, ///< The data passed in the file_walk callback is from an NTFS resident file
- TSK_FS_BLOCK_FLAG_AONLY = 0x0200 /// < The buffer in TSK_FS_BLOCK has no content (it could be non-empty, but should be ignored), but the flags and such are accurate
+ TSK_FS_BLOCK_FLAG_RES = 0x0100, ///< The data passed in the file_walk callback is from an NTFS resident file
+ TSK_FS_BLOCK_FLAG_AONLY = 0x0200 /// < The buffer in TSK_FS_BLOCK has no content (it could be non-empty, but should be ignored), but the flags and such are accurate
};
typedef enum TSK_FS_BLOCK_FLAG_ENUM TSK_FS_BLOCK_FLAG_ENUM;
@@ -89,7 +89,7 @@ extern "C" {
TSK_FS_BLOCK_WALK_FLAG_UNALLOC = 0x02, ///< Unallocated blocks
TSK_FS_BLOCK_WALK_FLAG_CONT = 0x04, ///< Blocks that could store file content
TSK_FS_BLOCK_WALK_FLAG_META = 0x08, ///< Blocks that could store file system metadata
- TSK_FS_BLOCK_WALK_FLAG_AONLY = 0x10 ///< Do not include content in callback only address and allocation status
+ TSK_FS_BLOCK_WALK_FLAG_AONLY = 0x10 ///< Do not include content in callback only address and allocation status
};
typedef enum TSK_FS_BLOCK_WALK_FLAG_ENUM TSK_FS_BLOCK_WALK_FLAG_ENUM;
@@ -122,8 +122,8 @@ extern "C" {
extern void tsk_fs_block_free(TSK_FS_BLOCK * a_fs_block);
extern TSK_FS_BLOCK *tsk_fs_block_get(TSK_FS_INFO * fs,
TSK_FS_BLOCK * fs_block, TSK_DADDR_T addr);
- extern TSK_FS_BLOCK *tsk_fs_block_get_flag(TSK_FS_INFO * a_fs,
- TSK_FS_BLOCK * a_fs_block, TSK_DADDR_T a_addr,
+ extern TSK_FS_BLOCK *tsk_fs_block_get_flag(TSK_FS_INFO * a_fs,
+ TSK_FS_BLOCK * a_fs_block, TSK_DADDR_T a_addr,
TSK_FS_BLOCK_FLAG_ENUM a_flags);
extern uint8_t tsk_fs_block_walk(TSK_FS_INFO * a_fs,
TSK_DADDR_T a_start_blk, TSK_DADDR_T a_end_blk,
@@ -219,7 +219,7 @@ extern "C" {
* with any changes.
*/
typedef enum {
- TSK_FS_ATTR_TYPE_NOT_FOUND = 0x00, // 0
+ TSK_FS_ATTR_TYPE_NOT_FOUND = 0x00, // 0
TSK_FS_ATTR_TYPE_DEFAULT = 0x01, // 1
TSK_FS_ATTR_TYPE_NTFS_SI = 0x10, // 16
TSK_FS_ATTR_TYPE_NTFS_ATTRLIST = 0x20, // 32
@@ -240,7 +240,7 @@ extern "C" {
TSK_FS_ATTR_TYPE_NTFS_PROP = 0xF0, // (NT)
TSK_FS_ATTR_TYPE_NTFS_LOG = 0x100, // (2K)
TSK_FS_ATTR_TYPE_UNIX_INDIR = 0x1001, // Indirect blocks for UFS and ExtX file systems
- TSK_FS_ATTR_TYPE_UNIX_EXTENT = 0x1002, // Extents for Ext4 file system
+ TSK_FS_ATTR_TYPE_UNIX_EXTENT = 0x1002, // Extents for Ext4 file system
// Types for HFS+ File Attributes
TSK_FS_ATTR_TYPE_HFS_DEFAULT = 0x01, // 1 Data fork of fs special files and misc
@@ -424,7 +424,7 @@ extern "C" {
typedef enum TSK_FS_META_CONTENT_TYPE_ENUM {
TSK_FS_META_CONTENT_TYPE_DEFAULT = 0x0,
- TSK_FS_META_CONTENT_TYPE_EXT4_EXTENTS = 0x1 ///< Ext4 with extents instead of individual pointers
+ TSK_FS_META_CONTENT_TYPE_EXT4_EXTENTS = 0x1 ///< Ext4 with extents instead of individual pointers
} TSK_FS_META_CONTENT_TYPE_ENUM;
@@ -476,7 +476,7 @@ extern "C" {
void *content_ptr; ///< Pointer to file system specific data that is used to store references to file content
size_t content_len; ///< size of content buffer
- TSK_FS_META_CONTENT_TYPE_ENUM content_type; ///< File system-specific and describes type of data in content_ptr in case file systems have multiple ways of storing things.
+ TSK_FS_META_CONTENT_TYPE_ENUM content_type; ///< File system-specific and describes type of data in content_ptr in case file systems have multiple ways of storing things.
uint32_t seq; ///< Sequence number for file (NTFS only, is incremented when entry is reallocated)
@@ -765,8 +765,8 @@ extern "C" {
TSK_FS_TYPE_HFS = 0x00001000, ///< HFS file system
TSK_FS_TYPE_HFS_DETECT = 0x00001000, ///< HFS auto detection
TSK_FS_TYPE_EXT4 = 0x00002000, ///< Ext4 file system
- TSK_FS_TYPE_YAFFS2 = 0x00003000, ///< YAFFS2 file system
- TSK_FS_TYPE_YAFFS2_DETECT = 0x00003000, ///< YAFFS2 auto detection
+ TSK_FS_TYPE_YAFFS2 = 0x00003000, ///< YAFFS2 file system
+ TSK_FS_TYPE_YAFFS2_DETECT = 0x00003000, ///< YAFFS2 auto detection
TSK_FS_TYPE_UNSUPP = 0xffffffff, ///< Unsupported file system
};
/* NOTE: Update bindings/java/src/org/sleuthkit/datamodel/TskData.java
@@ -842,7 +842,7 @@ extern "C" {
*/
enum TSK_FS_INFO_FLAG_ENUM {
TSK_FS_INFO_FLAG_NONE = 0x00, ///< No Flags
- TSK_FS_INFO_FLAG_HAVE_SEQ = 0x01, ///< File system has sequence numbers in the inode addresses.
+ TSK_FS_INFO_FLAG_HAVE_SEQ = 0x01, ///< File system has sequence numbers in the inode addresses.
TSK_FS_INFO_FLAG_HAVE_NANOSEC = 0x02 ///< Nano second field in times will be set.
};
typedef enum TSK_FS_INFO_FLAG_ENUM TSK_FS_INFO_FLAG_ENUM;
@@ -1446,9 +1446,7 @@ class TskFsAttribute {
return new TskFsAttrRun(run);
i++;
run = run->next;
- }
- }
- return NULL;
+ }} return NULL;
};
/**
@@ -1462,9 +1460,7 @@ class TskFsAttribute {
while (run != NULL) {
size++;
run = run->next;
- }
- }
- return size;
+ }} return size;
}
/**
@@ -2133,8 +2129,7 @@ class TskFsInfo {
return m_fsInfo->img_info;
else
return NULL;
- }
-}; //TskFsInfo
+}}; //TskFsInfo
@@ -2328,8 +2323,7 @@ class TskFsMeta {
while (nameList != NULL) {
nameList = nameList->next;
numOfList += 1;
- }
- m_nameListLen = numOfList;
+ } m_nameListLen = numOfList;
}
else {
m_nameList = NULL;
@@ -2573,7 +2567,7 @@ class TskFsMeta {
uint32_t getSeq() const {
if (m_fsMeta != NULL)
return m_fsMeta->seq;
- return 0xFFFF;
+ return 0xFFFF;
};
/**
@@ -2598,9 +2592,7 @@ class TskFsMeta {
while (name != NULL) {
size++;
name = name->next;
- }
- }
- return size;
+ }} return size;
};
/**
@@ -2617,9 +2609,7 @@ class TskFsMeta {
return new TskFsMetaName(name);
i++;
name = name->next;
- }
- }
- return NULL;
+ }} return NULL;
};
private:
diff --git a/tsk/fs/tsk_fs_i.h b/tsk/fs/tsk_fs_i.h
index e466969ccc1b635dc6dba0b70a1c2e0f8211cf36..27538e28de4e49c4039f9adf942957cbe15a56b7 100644
--- a/tsk/fs/tsk_fs_i.h
+++ b/tsk/fs/tsk_fs_i.h
@@ -166,7 +166,8 @@ extern "C" {
const TSK_FS_NAME * a_fs_name_from);
extern void tsk_fs_name_reset(TSK_FS_NAME * a_fs_name);
extern char *tsk_fs_time_to_str(time_t, char buf[128]);
- extern char *tsk_fs_time_to_str_subsecs(time_t, unsigned int subsecs, char buf[128]);
+ extern char *tsk_fs_time_to_str_subsecs(time_t, unsigned int subsecs,
+ char buf[128]);
/* Utilities */
extern uint8_t tsk_fs_unix_make_data_run(TSK_FS_FILE * fs_file);
diff --git a/tsk/fs/tsk_ntfs.h b/tsk/fs/tsk_ntfs.h
index 2013b5cdf7a914cccb599d4273277ed55c31b1e0..916d9e59e79c776028a3ac6ef298c807edf8144f 100644
--- a/tsk/fs/tsk_ntfs.h
+++ b/tsk/fs/tsk_ntfs.h
@@ -523,9 +523,9 @@ extern "C" {
* Structure used in Security Descriptor lookups
*/
typedef struct {
- char *buffer; ///< Buffer to store data in
- size_t size; ///< Number of bytes in buffer
- size_t used; ///< Number of records used in the buffer (size depends on type of data stored)
+ char *buffer; ///< Buffer to store data in
+ size_t size; ///< Number of bytes in buffer
+ size_t used; ///< Number of records used in the buffer (size depends on type of data stored)
} NTFS_SXX_BUFFER;
@@ -657,10 +657,10 @@ extern "C" {
extern int ntfs_name_cmp(TSK_FS_INFO *, const char *, const char *);
- extern uint8_t ntfs_find_file(TSK_FS_INFO * fs, TSK_INUM_T inode_toid, uint32_t type_toid,
- uint8_t type_used, uint16_t id_toid, uint8_t id_used,
- TSK_FS_DIR_WALK_FLAG_ENUM dir_walk_flags, TSK_FS_DIR_WALK_CB action,
- void *ptr);
+ extern uint8_t ntfs_find_file(TSK_FS_INFO * fs, TSK_INUM_T inode_toid,
+ uint32_t type_toid, uint8_t type_used, uint16_t id_toid,
+ uint8_t id_used, TSK_FS_DIR_WALK_FLAG_ENUM dir_walk_flags,
+ TSK_FS_DIR_WALK_CB action, void *ptr);
#ifdef __cplusplus
}
diff --git a/tsk/fs/tsk_yaffs.h b/tsk/fs/tsk_yaffs.h
index c0c1a1d3dc0554035401e1cbee3bec6b8f88cc1a..091741c350dc903ae5e9f79504741a759b4ad481 100644
--- a/tsk/fs/tsk_yaffs.h
+++ b/tsk/fs/tsk_yaffs.h
@@ -35,16 +35,15 @@ extern "C" {
/*
** Yaffs Object Flags
*/
-typedef enum
- {
- NONE,
- YAFFS_HEADER,
- YAFFS_CHUNK,
- YAFFS_PAGES,
- YAFFS_SPARES,
- YAFFS_PAGES_AND_SPARES,
- UNKNOWN
- } YAFFS_OBJECT_FLAGS;
+ typedef enum {
+ NONE,
+ YAFFS_HEADER,
+ YAFFS_CHUNK,
+ YAFFS_PAGES,
+ YAFFS_SPARES,
+ YAFFS_PAGES_AND_SPARES,
+ UNKNOWN
+ } YAFFS_OBJECT_FLAGS;
/*
** Yaffs2 Header Object
@@ -52,30 +51,30 @@ typedef enum
#define YAFFS_HEADER_NAME_LENGTH 256
#define YAFFS_HEADER_ALIAS_LENGTH 160
-typedef struct yaffsObj_header {
- uint32_t obj_type;
- uint32_t parent_id;
- char name[YAFFS_HEADER_NAME_LENGTH];
- uint32_t file_mode;
- uint32_t user_id;
- uint32_t group_id;
- uint32_t atime;
- uint32_t mtime;
- uint32_t ctime;
- uint32_t file_size;
- uint32_t equivalent_id;
- char alias[YAFFS_HEADER_ALIAS_LENGTH];
- uint32_t rdev_mode;
- uint32_t win_ctime[2];
- uint32_t win_atime[2];
- uint32_t win_mtime[2];
- uint32_t inband_obj_id;
- uint32_t inband_is_shrink;
- uint32_t file_size_high;
- uint32_t reserved[1];
- int shadows_obj;
- uint32_t is_shrink;
- } YaffsHeader;
+ typedef struct yaffsObj_header {
+ uint32_t obj_type;
+ uint32_t parent_id;
+ char name[YAFFS_HEADER_NAME_LENGTH];
+ uint32_t file_mode;
+ uint32_t user_id;
+ uint32_t group_id;
+ uint32_t atime;
+ uint32_t mtime;
+ uint32_t ctime;
+ uint32_t file_size;
+ uint32_t equivalent_id;
+ char alias[YAFFS_HEADER_ALIAS_LENGTH];
+ uint32_t rdev_mode;
+ uint32_t win_ctime[2];
+ uint32_t win_atime[2];
+ uint32_t win_mtime[2];
+ uint32_t inband_obj_id;
+ uint32_t inband_is_shrink;
+ uint32_t file_size_high;
+ uint32_t reserved[1];
+ int shadows_obj;
+ uint32_t is_shrink;
+ } YaffsHeader;
/*
** Spare object - this is subject to change...
@@ -91,31 +90,30 @@ typedef struct yaffsObj_header {
#define YAFFS_SPARE_OBJECT_TYPE_MASK 0xf0000000
- typedef struct yaffsObj_spare {
- uint32_t seq_number;
- uint32_t object_id;
- uint32_t chunk_id;
+ typedef struct yaffsObj_spare {
+ uint32_t seq_number;
+ uint32_t object_id;
+ uint32_t chunk_id;
- uint32_t has_extra_fields;
- uint32_t extra_object_type;
- uint32_t extra_parent_id;
- } YaffsSpare;
+ uint32_t has_extra_fields;
+ uint32_t extra_object_type;
+ uint32_t extra_parent_id;
+ } YaffsSpare;
/*
** Holds the metadata for a single YAFFS2 chunk.
*/
-typedef enum {
- YAFFS_CHUNK_DEAD, /* Either bad or unallocated */
- YAFFS_CHUNK_META, /* Contains a header */
- YAFFS_CHUNK_DATA /* Contains file data */
- } YaffsChunkType;
-
-typedef struct _YaffsChunk
- {
- YaffsChunkType type;
- YaffsSpare *spare;
- YaffsHeader *header;
- } YaffsChunk;
+ typedef enum {
+ YAFFS_CHUNK_DEAD, /* Either bad or unallocated */
+ YAFFS_CHUNK_META, /* Contains a header */
+ YAFFS_CHUNK_DATA /* Contains file data */
+ } YaffsChunkType;
+
+ typedef struct _YaffsChunk {
+ YaffsChunkType type;
+ YaffsSpare *spare;
+ YaffsHeader *header;
+ } YaffsChunk;
/* File system State Values */
#define YAFFSFS_STATE_VALID 0x0001 /* unmounted correctly */
@@ -147,48 +145,48 @@ typedef struct _YaffsChunk
-struct _YaffsCacheVersion;
-struct _YaffsCacheChunk;
+ struct _YaffsCacheVersion;
+ struct _YaffsCacheChunk;
-typedef struct _YaffsCacheObject {
- struct _YaffsCacheObject *yco_next;
+ typedef struct _YaffsCacheObject {
+ struct _YaffsCacheObject *yco_next;
- uint32_t yco_obj_id;
+ uint32_t yco_obj_id;
- struct _YaffsCacheVersion *yco_latest;
-} YaffsCacheObject;
+ struct _YaffsCacheVersion *yco_latest;
+ } YaffsCacheObject;
#define YAFFS_OBJECT_ID_MASK 0x0003ffff
#define YAFFS_VERSION_NUM_SHIFT 18
#define YAFFS_VERSION_NUM_MASK 0x00003fff
-typedef struct _YaffsCacheVersion {
- struct _YaffsCacheVersion *ycv_prior;
+ typedef struct _YaffsCacheVersion {
+ struct _YaffsCacheVersion *ycv_prior;
- uint32_t ycv_version;
- uint32_t ycv_seq_number;
+ uint32_t ycv_version;
+ uint32_t ycv_seq_number;
- struct _YaffsCacheChunk *ycv_header_chunk;
- struct _YaffsCacheChunk *ycv_first_chunk;
- struct _YaffsCacheChunk *ycv_last_chunk;
-} YaffsCacheVersion;
+ struct _YaffsCacheChunk *ycv_header_chunk;
+ struct _YaffsCacheChunk *ycv_first_chunk;
+ struct _YaffsCacheChunk *ycv_last_chunk;
+ } YaffsCacheVersion;
-typedef struct _YaffsCacheChunk {
- struct _YaffsCacheChunk *ycc_next;
- struct _YaffsCacheChunk *ycc_prev;
+ typedef struct _YaffsCacheChunk {
+ struct _YaffsCacheChunk *ycc_next;
+ struct _YaffsCacheChunk *ycc_prev;
- TSK_OFF_T ycc_offset;
- uint32_t ycc_seq_number;
- uint32_t ycc_obj_id;
- uint32_t ycc_chunk_id;
- uint32_t ycc_parent_id;
- uint32_t ycc_n_bytes;
-} YaffsCacheChunk;
+ TSK_OFF_T ycc_offset;
+ uint32_t ycc_seq_number;
+ uint32_t ycc_obj_id;
+ uint32_t ycc_chunk_id;
+ uint32_t ycc_parent_id;
+ uint32_t ycc_n_bytes;
+ } YaffsCacheChunk;
-typedef struct _YaffsCacheChunkGroup {
- YaffsCacheChunk * cache_chunks_head;
- YaffsCacheChunk * cache_chunks_tail;
-} YaffsCacheChunkGroup;
+ typedef struct _YaffsCacheChunkGroup {
+ YaffsCacheChunk *cache_chunks_head;
+ YaffsCacheChunk *cache_chunks_tail;
+ } YaffsCacheChunkGroup;
/*
* Structure of an yaffsfs file system handle.
@@ -198,23 +196,23 @@ typedef struct _YaffsCacheChunkGroup {
unsigned int page_size;
unsigned int spare_size;
- unsigned int chunks_per_block;
+ unsigned int chunks_per_block;
- uint32_t max_obj_id;
- uint32_t max_version;
+ uint32_t max_obj_id;
+ uint32_t max_version;
- // Offsets into the spare area
- unsigned int spare_seq_offset;
- unsigned int spare_obj_id_offset;
- unsigned int spare_chunk_id_offset;
- unsigned int spare_nbytes_offset;
+ // Offsets into the spare area
+ unsigned int spare_seq_offset;
+ unsigned int spare_obj_id_offset;
+ unsigned int spare_chunk_id_offset;
+ unsigned int spare_nbytes_offset;
tsk_lock_t cache_lock;
YaffsCacheObject *cache_objects;
- std::map<uint32_t, YaffsCacheChunkGroup> * chunkMap;
+ std::map < uint32_t, YaffsCacheChunkGroup > *chunkMap;
- // If the user specified that the image is YAFFS2, print out additional verbose error messages
- int autoDetect;
+ // If the user specified that the image is YAFFS2, print out additional verbose error messages
+ int autoDetect;
} YAFFSFS_INFO;
#define YAFFS_FILE_CONTENT_LEN 0