diff --git a/tsk3/fs/ext2fs.c b/tsk3/fs/ext2fs.c index b70db5c159826ae8f7cf8a058365e4c035e4d1c4..86dd77460ee1d02c185139d95e2c40aa2e50afc2 100644 --- a/tsk3/fs/ext2fs.c +++ b/tsk3/fs/ext2fs.c @@ -886,6 +886,9 @@ ext2fs_block_getflags(TSK_FS_INFO * a_fs, TSK_DADDR_T a_addr) TSK_DADDR_T dmin = 0; /* first block after inodes */ // these blocks are not described in the group descriptors + // sparse + if (a_addr == 0) + return TSK_FS_BLOCK_FLAG_CONT | TSK_FS_BLOCK_FLAG_ALLOC; if (a_addr < ext2fs->first_data_block) return TSK_FS_BLOCK_FLAG_META | TSK_FS_BLOCK_FLAG_ALLOC; diff --git a/tsk3/fs/ffs.c b/tsk3/fs/ffs.c index a78d213b87f6446777d7b24ac70b81c05a714dec..b6078d85a8928a6dfd3d23df619fc6be3d5a0856 100644 --- a/tsk3/fs/ffs.c +++ b/tsk3/fs/ffs.c @@ -1046,6 +1046,10 @@ ffs_block_getflags(TSK_FS_INFO * a_fs, TSK_DADDR_T a_addr) unsigned char *freeblocks = NULL; int flags; + // sparse + if (a_addr == 0) + return TSK_FS_BLOCK_FLAG_CONT | TSK_FS_BLOCK_FLAG_ALLOC; + grp_num = dtog_lcl(a_fs, ffs->fs.sb1, a_addr); if (ffs_group_load(ffs, grp_num)) { diff --git a/tsk3/fs/tsk_fs.h b/tsk3/fs/tsk_fs.h index 31ae6187130fbb5d8f8b1d824901543f2d862596..a1d96e1899da3040a4126f6f883aa15d6969875f 100644 --- a/tsk3/fs/tsk_fs.h +++ b/tsk3/fs/tsk_fs.h @@ -64,11 +64,11 @@ extern "C" { TSK_FS_BLOCK_FLAG_UNALLOC = 0x0002, ///< Block is unallocated (and not TSK_FS_BLOCK_FLAG_ALLOC) TSK_FS_BLOCK_FLAG_CONT = 0x0004, ///< Block (could) contain file content (and not TSK_FS_BLOCK_FLAG_META) TSK_FS_BLOCK_FLAG_META = 0x0008, ///< Block (could) contain file system metadata (and not TSK_FS_BLOCK_FLAG_CONT) - TSK_FS_BLOCK_FLAG_RAW = 0x0010, ///< The data has been read raw from the disk and is not compressed, encrypted, sparse etc. - TSK_FS_BLOCK_FLAG_BAD = 0x0020, ///< Block has been marked as bad by the file system - TSK_FS_BLOCK_FLAG_RES = 0x0040, ///< The data passed in the file_walk callback is from an NTFS resident file - TSK_FS_BLOCK_FLAG_SPARSE = 0x0080, ///< The data passed in the file_walk calback was stored as sparse (all zeros) - TSK_FS_BLOCK_FLAG_COMP = 0x0100 ///< The data passed in the file_walk callback was stored in a compressed form + TSK_FS_BLOCK_FLAG_BAD = 0x0010, ///< Block has been marked as bad by the file system + TSK_FS_BLOCK_FLAG_RAW = 0x0020, ///< The data has been read raw from the disk (and not COMP or SPARSE) + TSK_FS_BLOCK_FLAG_SPARSE = 0x0040, ///< The data passed in the file_walk calback was stored as sparse (all zeros) (and not RAW or COMP) + TSK_FS_BLOCK_FLAG_COMP = 0x0080, ///< The data passed in the file_walk callback was stored in a compressed form (and not RAW or SPARSE) + TSK_FS_BLOCK_FLAG_RES = 0x0100 ///< The data passed in the file_walk callback is from an NTFS resident file }; typedef enum TSK_FS_BLOCK_FLAG_ENUM TSK_FS_BLOCK_FLAG_ENUM;