Skip to content
Snippets Groups Projects
Commit 9498cb2f authored by Brian Carrier's avatar Brian Carrier
Browse files

fixed hfind to work on EnCase hashsets with index is not specified

parent 3ca56c52
No related branches found
No related tags found
No related merge requests found
...@@ -8,6 +8,7 @@ Core: ...@@ -8,6 +8,7 @@ Core:
- Added NTFS FNAME times to time2 struct in TSK_FS_META to make them - Added NTFS FNAME times to time2 struct in TSK_FS_META to make them
easier to access -- should have done this a long time ago! easier to access -- should have done this a long time ago!
- fls -m and tsk_gettimes output NTFS FNAME times to output for timelines. - fls -m and tsk_gettimes output NTFS FNAME times to output for timelines.
- hfind with EnCase hashsets works when DB is specified (and not only index)
---------------- VERSION 4.1.0 -------------- ---------------- VERSION 4.1.0 --------------
......
...@@ -625,6 +625,18 @@ hdb_setupindex(TSK_HDB_INFO * hdb_info, uint8_t htype) ...@@ -625,6 +625,18 @@ hdb_setupindex(TSK_HDB_INFO * hdb_info, uint8_t htype)
return 1; return 1;
} }
} }
else if (strcmp(ptr, TSK_HDB_DBTYPE_ENCASE_STR) == 0) {
if ((hdb_info->db_type != TSK_HDB_DBTYPE_ENCASE_ID) &&
(hdb_info->db_type != TSK_HDB_DBTYPE_IDXONLY_ID)) {
tsk_release_lock(&hdb_info->lock);
tsk_error_reset();
tsk_error_set_errno(TSK_ERR_HDB_UNKTYPE);
tsk_error_set_errstr(
"hdb_indexsetup: DB detected as %s, index type has EnCase",
ptr);
return 1;
}
}
else if (hdb_info->db_type != TSK_HDB_DBTYPE_IDXONLY_ID) { else if (hdb_info->db_type != TSK_HDB_DBTYPE_IDXONLY_ID) {
tsk_release_lock(&hdb_info->lock); tsk_release_lock(&hdb_info->lock);
tsk_error_reset(); tsk_error_reset();
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment