diff --git a/tsk/auto/auto_db.cpp b/tsk/auto/auto_db.cpp index 43b84169e186b4603470bb4dbb7f1b41a38e8d00..6d3effe974302ea7d295f65f53201145b6d1172f 100755 --- a/tsk/auto/auto_db.cpp +++ b/tsk/auto/auto_db.cpp @@ -329,6 +329,16 @@ TskAutoDb::filterPool(const TSK_POOL_INFO * pool_info) return TSK_FILTER_CONT; } +TSK_FILTER_ENUM +TskAutoDb::addUnallocatedPoolBlocks(const TSK_POOL_INFO * pool_info) { + /* Only APFS pools are currently supported */ + if (pool_info->ctype != TSK_POOL_TYPE_APFS) { + return TSK_FILTER_CONT; + } + + +} + TSK_FILTER_ENUM TskAutoDb::filterPoolVol(const TSK_POOL_VOLUME_INFO * pool_vol) { @@ -1032,7 +1042,7 @@ TSK_WALK_RET_ENUM TskAutoDb::fsWalkUnallocBlocksCb(const TSK_FS_BLOCK *a_block, */ TSK_RETVAL_ENUM TskAutoDb::addFsInfoUnalloc(const TSK_DB_FS_INFO & dbFsInfo) { - // Unalloc space is not yet implemented for APFS + // Unalloc space is handled separately for APFS if (dbFsInfo.fType == TSK_FS_TYPE_APFS) { return TSK_OK; } diff --git a/tsk/auto/tsk_case_db.h b/tsk/auto/tsk_case_db.h index eee845990c82acf2f44045eb540398e6f53ce6e3..d8750f6153897c35eb6ba9eceab8e0ec659d58df 100644 --- a/tsk/auto/tsk_case_db.h +++ b/tsk/auto/tsk_case_db.h @@ -186,6 +186,7 @@ class TskAutoDb:public TskAuto { TSK_OFF_T offset, TSK_DADDR_T addr, char *buf, size_t size, TSK_FS_BLOCK_FLAG_ENUM a_flags, void *ptr); int md5HashAttr(unsigned char md5Hash[16], const TSK_FS_ATTR * fs_attr); + TSK_FILTER_ENUM addUnallocatedPoolBlocks(const TSK_POOL_INFO * pool_info); static TSK_WALK_RET_ENUM fsWalkUnallocBlocksCb(const TSK_FS_BLOCK *a_block, void *a_ptr); TSK_RETVAL_ENUM addFsInfoUnalloc(const TSK_DB_FS_INFO & dbFsInfo);