From 86903d1a6936ecc142bd4d77ecb952d58c94f37f Mon Sep 17 00:00:00 2001
From: Brian Carrier <carrier@sleuthkit.org>
Date: Mon, 29 Dec 2008 17:58:57 +0000
Subject: [PATCH] Fix bug that caused ext/ffs sparse blocks to not be set as
content block-type (2475246)
---
tsk3/fs/ext2fs.c | 3 +++
tsk3/fs/ffs.c | 4 ++++
tsk3/fs/tsk_fs.h | 10 +++++-----
3 files changed, 12 insertions(+), 5 deletions(-)
diff --git a/tsk3/fs/ext2fs.c b/tsk3/fs/ext2fs.c
index b70db5c15..86dd77460 100644
--- a/tsk3/fs/ext2fs.c
+++ b/tsk3/fs/ext2fs.c
@@ -886,6 +886,9 @@ ext2fs_block_getflags(TSK_FS_INFO * a_fs, TSK_DADDR_T a_addr)
TSK_DADDR_T dmin = 0; /* first block after inodes */
// these blocks are not described in the group descriptors
+ // sparse
+ if (a_addr == 0)
+ return TSK_FS_BLOCK_FLAG_CONT | TSK_FS_BLOCK_FLAG_ALLOC;
if (a_addr < ext2fs->first_data_block)
return TSK_FS_BLOCK_FLAG_META | TSK_FS_BLOCK_FLAG_ALLOC;
diff --git a/tsk3/fs/ffs.c b/tsk3/fs/ffs.c
index a78d213b8..b6078d85a 100644
--- a/tsk3/fs/ffs.c
+++ b/tsk3/fs/ffs.c
@@ -1046,6 +1046,10 @@ ffs_block_getflags(TSK_FS_INFO * a_fs, TSK_DADDR_T a_addr)
unsigned char *freeblocks = NULL;
int flags;
+ // sparse
+ if (a_addr == 0)
+ return TSK_FS_BLOCK_FLAG_CONT | TSK_FS_BLOCK_FLAG_ALLOC;
+
grp_num = dtog_lcl(a_fs, ffs->fs.sb1, a_addr);
if (ffs_group_load(ffs, grp_num)) {
diff --git a/tsk3/fs/tsk_fs.h b/tsk3/fs/tsk_fs.h
index 31ae61871..a1d96e189 100644
--- a/tsk3/fs/tsk_fs.h
+++ b/tsk3/fs/tsk_fs.h
@@ -64,11 +64,11 @@ extern "C" {
TSK_FS_BLOCK_FLAG_UNALLOC = 0x0002, ///< Block is unallocated (and not TSK_FS_BLOCK_FLAG_ALLOC)
TSK_FS_BLOCK_FLAG_CONT = 0x0004, ///< Block (could) contain file content (and not TSK_FS_BLOCK_FLAG_META)
TSK_FS_BLOCK_FLAG_META = 0x0008, ///< Block (could) contain file system metadata (and not TSK_FS_BLOCK_FLAG_CONT)
- TSK_FS_BLOCK_FLAG_RAW = 0x0010, ///< The data has been read raw from the disk and is not compressed, encrypted, sparse etc.
- TSK_FS_BLOCK_FLAG_BAD = 0x0020, ///< Block has been marked as bad by the file system
- TSK_FS_BLOCK_FLAG_RES = 0x0040, ///< The data passed in the file_walk callback is from an NTFS resident file
- TSK_FS_BLOCK_FLAG_SPARSE = 0x0080, ///< The data passed in the file_walk calback was stored as sparse (all zeros)
- TSK_FS_BLOCK_FLAG_COMP = 0x0100 ///< The data passed in the file_walk callback was stored in a compressed form
+ TSK_FS_BLOCK_FLAG_BAD = 0x0010, ///< Block has been marked as bad by the file system
+ TSK_FS_BLOCK_FLAG_RAW = 0x0020, ///< The data has been read raw from the disk (and not COMP or SPARSE)
+ TSK_FS_BLOCK_FLAG_SPARSE = 0x0040, ///< The data passed in the file_walk calback was stored as sparse (all zeros) (and not RAW or COMP)
+ TSK_FS_BLOCK_FLAG_COMP = 0x0080, ///< The data passed in the file_walk callback was stored in a compressed form (and not RAW or SPARSE)
+ TSK_FS_BLOCK_FLAG_RES = 0x0100 ///< The data passed in the file_walk callback is from an NTFS resident file
};
typedef enum TSK_FS_BLOCK_FLAG_ENUM TSK_FS_BLOCK_FLAG_ENUM;
--
GitLab