diff --git a/tsk/auto/auto_db.cpp b/tsk/auto/auto_db.cpp index 5ede98c32692c36ebb0cf1234004942084f850f8..05ae5fc79d857d41a3552865a4b893aa38988ed1 100644 --- a/tsk/auto/auto_db.cpp +++ b/tsk/auto/auto_db.cpp @@ -742,6 +742,7 @@ TSK_WALK_RET_ENUM TskAutoDb::fsWalkUnallocBlocksCb(const TSK_FS_BLOCK *a_block, unallocBlockWlkTrack->curRangeStart = a_block->addr; unallocBlockWlkTrack->prevBlock = a_block->addr; unallocBlockWlkTrack->size = 0; + unallocBlockWlkTrack->nextSequenceNo = 0; return TSK_WALK_CONT; } @@ -756,7 +757,7 @@ TSK_WALK_RET_ENUM TskAutoDb::fsWalkUnallocBlocksCb(const TSK_FS_BLOCK *a_block, + unallocBlockWlkTrack->fsInfo.offset; const uint64_t rangeSizeBytes = (1 + unallocBlockWlkTrack->prevBlock - unallocBlockWlkTrack->curRangeStart) * unallocBlockWlkTrack->fsInfo.block_size; - unallocBlockWlkTrack->ranges.push_back(TSK_DB_FILE_LAYOUT_RANGE(rangeStartOffset, rangeSizeBytes, 0)); + unallocBlockWlkTrack->ranges.push_back(TSK_DB_FILE_LAYOUT_RANGE(rangeStartOffset, rangeSizeBytes, unallocBlockWlkTrack->nextSequenceNo++)); // bookkeeping for the next range object unallocBlockWlkTrack->size += rangeSizeBytes; @@ -784,6 +785,7 @@ TSK_WALK_RET_ENUM TskAutoDb::fsWalkUnallocBlocksCb(const TSK_FS_BLOCK *a_block, unallocBlockWlkTrack->curRangeStart = a_block->addr; unallocBlockWlkTrack->size = 0; unallocBlockWlkTrack->ranges.clear(); + unallocBlockWlkTrack->nextSequenceNo = 0; //we don't know what the last unalloc block is in advance //and will handle the last range in addFsInfoUnalloc() @@ -839,7 +841,7 @@ TSK_RETVAL_ENUM TskAutoDb::addFsInfoUnalloc(const TSK_DB_FS_INFO & dbFsInfo) { // make range inclusive from curBlockStart to prevBlock const uint64_t byteStart = unallocBlockWlkTrack.curRangeStart * fsInfo->block_size + fsInfo->offset; const uint64_t byteLen = (1 + unallocBlockWlkTrack.prevBlock - unallocBlockWlkTrack.curRangeStart) * fsInfo->block_size; - unallocBlockWlkTrack.ranges.push_back(TSK_DB_FILE_LAYOUT_RANGE(byteStart, byteLen, 0)); + unallocBlockWlkTrack.ranges.push_back(TSK_DB_FILE_LAYOUT_RANGE(byteStart, byteLen, unallocBlockWlkTrack.nextSequenceNo++)); unallocBlockWlkTrack.size += byteLen; int64_t fileObjId = 0; diff --git a/tsk/auto/tsk_case_db.h b/tsk/auto/tsk_case_db.h index 634f12f3ee9e7eecf4784df8753545e291c2fafb..7452b17b4f4e20250e3d6f6ff716ed3279c6caa4 100644 --- a/tsk/auto/tsk_case_db.h +++ b/tsk/auto/tsk_case_db.h @@ -126,7 +126,7 @@ class TskAutoDb:public TskAuto { //internal structure to keep track of temp. unalloc block range typedef struct _UNALLOC_BLOCK_WLK_TRACK { _UNALLOC_BLOCK_WLK_TRACK(const TskAutoDb & tskAutoDb, const TSK_FS_INFO & fsInfo, const int64_t fsObjId, int64_t chunkSize) - : tskAutoDb(tskAutoDb),fsInfo(fsInfo),fsObjId(fsObjId),curRangeStart(0), chunkSize(chunkSize), prevBlock(0), isStart(true) {} + : tskAutoDb(tskAutoDb),fsInfo(fsInfo),fsObjId(fsObjId),curRangeStart(0), chunkSize(chunkSize), prevBlock(0), isStart(true), nextSequenceNo(0) {} const TskAutoDb & tskAutoDb; const TSK_FS_INFO & fsInfo; const int64_t fsObjId; @@ -136,6 +136,7 @@ class TskAutoDb:public TskAuto { const int64_t chunkSize; TSK_DADDR_T prevBlock; bool isStart; + uint32_t nextSequenceNo; } UNALLOC_BLOCK_WLK_TRACK; uint8_t addImageDetails(const char *const images[], int); diff --git a/tsk/auto/tsk_db_sqlite.h b/tsk/auto/tsk_db_sqlite.h index 8eeae9b9a691813215efd7de6073ef09d96af69e..9be9648659d81ea5b35ec13345b79eeca65d9a5e 100755 --- a/tsk/auto/tsk_db_sqlite.h +++ b/tsk/auto/tsk_db_sqlite.h @@ -98,7 +98,7 @@ typedef struct _TSK_DB_FILE_LAYOUT_RANGE { int64_t fileObjId; ///< set to 0 if unknown (before it becomes a db object) uint64_t byteStart; uint64_t byteLen; - int sequence; + uint32_t sequence; //default comparator by sequence bool operator< (const struct _TSK_DB_FILE_LAYOUT_RANGE & rhs) const