From b77a960ed87e5391c284f8d51db22cfba183c535 Mon Sep 17 00:00:00 2001
From: Ann Priestman <apriestman@basistech.com>
Date: Thu, 24 Aug 2017 08:47:55 -0400
Subject: [PATCH] Only break up the unalloc file if minChunkSize was given
---
tsk/auto/auto_db.cpp | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tsk/auto/auto_db.cpp b/tsk/auto/auto_db.cpp
index 3bf7b98b5..3caffdf88 100644
--- a/tsk/auto/auto_db.cpp
+++ b/tsk/auto/auto_db.cpp
@@ -910,7 +910,7 @@ TSK_WALK_RET_ENUM TskAutoDb::fsWalkUnallocBlocksCb(const TSK_FS_BLOCK *a_block,
// We want to keep consecutive blocks in the same run, so simply update prevBlock and the size
// if this one is consecutive with the last call. But, if we have hit the max chunk
// size, then break up this set of consecutive blocks.
- if ((a_block->addr == unallocBlockWlkTrack->prevBlock + 1) && ((unallocBlockWlkTrack->maxChunkSize == 0) ||
+ if ((a_block->addr == unallocBlockWlkTrack->prevBlock + 1) && ((unallocBlockWlkTrack->minChunkSize <= 0) ||
(unallocBlockWlkTrack->size < unallocBlockWlkTrack->maxChunkSize))) {
unallocBlockWlkTrack->prevBlock = a_block->addr;
unallocBlockWlkTrack->size += unallocBlockWlkTrack->fsInfo.block_size;
--
GitLab