From a8e1eb5878889763e19208c52a0af55710fef1f7 Mon Sep 17 00:00:00 2001
From: Ann Priestman <apriestman@basistech.com>
Date: Tue, 28 Jan 2020 14:07:41 -0500
Subject: [PATCH] Starting work
---
tsk/auto/auto_db.cpp | 12 +++++++++++-
tsk/auto/tsk_case_db.h | 1 +
2 files changed, 12 insertions(+), 1 deletion(-)
diff --git a/tsk/auto/auto_db.cpp b/tsk/auto/auto_db.cpp
index 43b84169e..6d3effe97 100755
--- a/tsk/auto/auto_db.cpp
+++ b/tsk/auto/auto_db.cpp
@@ -329,6 +329,16 @@ TskAutoDb::filterPool(const TSK_POOL_INFO * pool_info)
return TSK_FILTER_CONT;
}
+TSK_FILTER_ENUM
+TskAutoDb::addUnallocatedPoolBlocks(const TSK_POOL_INFO * pool_info) {
+ /* Only APFS pools are currently supported */
+ if (pool_info->ctype != TSK_POOL_TYPE_APFS) {
+ return TSK_FILTER_CONT;
+ }
+
+
+}
+
TSK_FILTER_ENUM
TskAutoDb::filterPoolVol(const TSK_POOL_VOLUME_INFO * pool_vol)
{
@@ -1032,7 +1042,7 @@ TSK_WALK_RET_ENUM TskAutoDb::fsWalkUnallocBlocksCb(const TSK_FS_BLOCK *a_block,
*/
TSK_RETVAL_ENUM TskAutoDb::addFsInfoUnalloc(const TSK_DB_FS_INFO & dbFsInfo) {
- // Unalloc space is not yet implemented for APFS
+ // Unalloc space is handled separately for APFS
if (dbFsInfo.fType == TSK_FS_TYPE_APFS) {
return TSK_OK;
}
diff --git a/tsk/auto/tsk_case_db.h b/tsk/auto/tsk_case_db.h
index eee845990..d8750f615 100644
--- a/tsk/auto/tsk_case_db.h
+++ b/tsk/auto/tsk_case_db.h
@@ -186,6 +186,7 @@ class TskAutoDb:public TskAuto {
TSK_OFF_T offset, TSK_DADDR_T addr, char *buf, size_t size,
TSK_FS_BLOCK_FLAG_ENUM a_flags, void *ptr);
int md5HashAttr(unsigned char md5Hash[16], const TSK_FS_ATTR * fs_attr);
+ TSK_FILTER_ENUM addUnallocatedPoolBlocks(const TSK_POOL_INFO * pool_info);
static TSK_WALK_RET_ENUM fsWalkUnallocBlocksCb(const TSK_FS_BLOCK *a_block, void *a_ptr);
TSK_RETVAL_ENUM addFsInfoUnalloc(const TSK_DB_FS_INFO & dbFsInfo);
--
GitLab