diff --git a/NEWS.txt b/NEWS.txt index 9b3ed9191229c18b55d2338cfe8e73c3e8ab34b3..c04dec0f55ff3de33b0ed05b5d1d3f79f0bc187b 100644 --- a/NEWS.txt +++ b/NEWS.txt @@ -12,6 +12,7 @@ New Features: New Features: - new TskAuto method (handleNotification()) that gets verbose messages that allow for debugging when the class makes decisions. - DOS partitions are loaded even if an extended partition fails to load +- new TskAuto::findFilesInFs(TSK_FS_INFO *) method ---------------- VERSION 3.2.2 -------------- diff --git a/tsk3/auto/auto.cpp b/tsk3/auto/auto.cpp index 27fdd644e05963401c7092a7e8cbb2baef1f8733..54330e10a8a02b87340a546d6799cc00d3d4ffdd 100644 --- a/tsk3/auto/auto.cpp +++ b/tsk3/auto/auto.cpp @@ -215,7 +215,7 @@ TSK_WALK_RET_ENUM /** - * Starts in a specified sector of the opened disk images and looks for a + * Starts in a specified byte offset of the opened disk images and looks for a * volume system or file system. Will call processFile() on each file * that is found. * @param a_start Byte offset to start analyzing from. @@ -271,7 +271,7 @@ uint8_t TskAuto::findFilesInVs(TSK_OFF_T a_start, TSK_VS_TYPE_ENUM a_vtype) } /** - * Starts in a specified sector of the opened disk images and looks for a + * Starts in a specified byte offset of the opened disk images and looks for a * volume system or file system. Will call processFile() on each file * that is found. * @param a_start Byte offset to start analyzing from. @@ -284,7 +284,7 @@ uint8_t TskAuto::findFilesInVs(TSK_OFF_T a_start) /** - * Starts in a specified sector of the opened disk images and looks for a + * Starts in a specified byte offset of the opened disk images and looks for a * file system. Will call processFile() on each file * that is found. Same as findFilesInFs, but gives more detailed return values. * @param a_start Byte offset to start analyzing from. @@ -324,8 +324,28 @@ TSK_RETVAL_ENUM return retval; } +/** + * Processes the file system represented by the given TSK_FS_INFO + * pointer. Will Call processFile() on each file that is found. + * + * @param a_fs_info Pointer to a previously opened file system. + * + * @returns 1 on error and 0 on success + */ +uint8_t TskAuto::findFilesInFs(TSK_FS_INFO *a_fs_info) +{ + if (a_fs_info == NULL) + return 1; + + if (findFilesInFsInt(a_fs_info, a_fs_info->root_inum) == TSK_ERR) + return 1; + else + return 0; +} + + /** - * Starts in a specified sector of the opened disk images and looks for a + * Starts in a specified byte offset of the opened disk images and looks for a * file system. Will call processFile() on each file * that is found. * @@ -343,7 +363,7 @@ uint8_t TskAuto::findFilesInFs(TSK_OFF_T a_start) /** - * Starts in a specified sector of the opened disk images and looks for a + * Starts in a specified byte offset of the opened disk images and looks for a * file system. Will call processFile() on each file * that is found. * @@ -361,7 +381,7 @@ uint8_t TskAuto::findFilesInFs(TSK_OFF_T a_start, TSK_FS_TYPE_ENUM a_ftype) } /** - * Starts in a specified sector of the opened disk images and looks for a + * Starts in a specified byte offset of the opened disk images and looks for a * file system. Will start processing the file system at a specified * file system. Will call processFile() on each file * that is found in that directory. @@ -410,7 +430,7 @@ uint8_t /** - * Starts in a specified sector of the opened disk images and looks for a + * Starts in a specified byte offset of the opened disk images and looks for a * file system. Will start processing the file system at a specified * file system. Will call processFile() on each file * that is found in that directory. diff --git a/tsk3/auto/tsk_auto.h b/tsk3/auto/tsk_auto.h index 81ade0c5d471ebe7f09666d28b3f416c6254385c..ca531d51b954286e43cd654d5b5275293f6ada7a 100644 --- a/tsk3/auto/tsk_auto.h +++ b/tsk3/auto/tsk_auto.h @@ -75,6 +75,7 @@ class TskAuto { uint8_t findFilesInFs(TSK_OFF_T start, TSK_INUM_T inum); uint8_t findFilesInFs(TSK_OFF_T start, TSK_FS_TYPE_ENUM ftype, TSK_INUM_T inum); + uint8_t findFilesInFs(TSK_FS_INFO *a_fs_info); TSK_RETVAL_ENUM findFilesInFsRet(TSK_OFF_T start, TSK_FS_TYPE_ENUM a_ftype);