Starting work

tsk/auto/auto_db.cpp

@@ -329,6 +329,16 @@ TskAutoDb::filterPool(const TSK_POOL_INFO * pool_info)
     return TSK_FILTER_CONT;
 }
 
+TSK_FILTER_ENUM
+TskAutoDb::addUnallocatedPoolBlocks(const TSK_POOL_INFO * pool_info) {
+    /* Only APFS pools are currently supported */
+    if (pool_info->ctype != TSK_POOL_TYPE_APFS) {
+        return TSK_FILTER_CONT;
+    }
+
+
+}
+
 TSK_FILTER_ENUM
 TskAutoDb::filterPoolVol(const TSK_POOL_VOLUME_INFO * pool_vol)
 {
@@ -1032,7 +1042,7 @@ TSK_WALK_RET_ENUM TskAutoDb::fsWalkUnallocBlocksCb(const TSK_FS_BLOCK *a_block,
 */
 TSK_RETVAL_ENUM TskAutoDb::addFsInfoUnalloc(const TSK_DB_FS_INFO & dbFsInfo) {
 
-    // Unalloc space is not yet implemented for APFS
+    // Unalloc space is handled separately for APFS
     if (dbFsInfo.fType == TSK_FS_TYPE_APFS) {
         return TSK_OK;
     }

tsk/auto/tsk_case_db.h

@@ -186,6 +186,7 @@ class TskAutoDb:public TskAuto {
         TSK_OFF_T offset, TSK_DADDR_T addr, char *buf, size_t size,
         TSK_FS_BLOCK_FLAG_ENUM a_flags, void *ptr);
     int md5HashAttr(unsigned char md5Hash[16], const TSK_FS_ATTR * fs_attr);
+    TSK_FILTER_ENUM addUnallocatedPoolBlocks(const TSK_POOL_INFO * pool_info);
 
     static TSK_WALK_RET_ENUM fsWalkUnallocBlocksCb(const TSK_FS_BLOCK *a_block, void *a_ptr);
     TSK_RETVAL_ENUM addFsInfoUnalloc(const TSK_DB_FS_INFO & dbFsInfo);