diff --git a/Makefile.am b/Makefile.am
index 42d3432c4a00d9bc792d4afe71c03a6e758f9d71..bc377efc069939e44537fdf9f6c0bd2e5afbf28a 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -1,6 +1,7 @@
# File that we want to include in the dist
EXTRA_DIST = README_win32.txt README.md INSTALL.txt ChangeLog.txt NEWS.txt API-CHANGES.txt \
- licenses/GNU-COPYING licenses/IBM-LICENSE licenses/cpl1.0.txt \
+ licenses/GNU-COPYING licenses/IBM-LICENSE \
+ licenses/cpl1.0.txt licenses/bsd.txt licenses/mit.txt \
m4/*.m4 \
docs/README.txt \
packages/sleuthkit.spec \
diff --git a/README.md b/README.md
index ce20a6a82d80ee1a00857bfb76208f84cc2410e3..ff66ccf0beae568ebcbe1a3db96d3eb3429e7ff4 100644
--- a/README.md
+++ b/README.md
@@ -147,12 +147,21 @@ file for more details.
## LICENSE
-The file system tools (in the [tools/fstools](https://github.com/sleuthkit/sleuthkit/tree/develop/tools/fstools)
- directory) are released under the IBM open source license and Common Public License, both
-are located in the [licenses directory](https://github.com/sleuthkit/sleuthkit/tree/develop/licenses).
-The modifications to 'mactime' from the original 'mactime' in TCT and 'mac-daddy' are released
-under the Common Public License. Other tools in the tools directory
-are either Common Public License or the GNU Public License.
+There are a variety of licenses used in TSK based on where they
+were first developed. The licenses are located in the [licenses
+directory](https://github.com/sleuthkit/sleuthkit/tree/develop/licenses).
+
+- The file system tools (in the
+[tools/fstools](https://github.com/sleuthkit/sleuthkit/tree/develop/tools/fstools)
+directory) are released under the IBM open source license and Common
+Public License.
+- srch_strings and fiwalk are released under the GNU Public License
+- Other tools in the tools directory are Common Public License
+- The modifications to 'mactime' from the original 'mactime' in TCT
+and 'mac-daddy' are released under the Common Public License.
+
+The library uses utilities that were released under MIT and BSD 3-clause.
+
## INSTALL
For installation instructions, refer to the INSTALL.txt document.
diff --git a/bindings/java/doxygen/artifact_catalog.dox b/bindings/java/doxygen/artifact_catalog.dox
index b208a111faf2695caa614a3bf3375fa4835c3fef..a71ac32eb5045d10fdf80221596b4fe822496dbc 100644
--- a/bindings/java/doxygen/artifact_catalog.dox
+++ b/bindings/java/doxygen/artifact_catalog.dox
@@ -241,7 +241,8 @@ A generic information artifact.
### REQUIRED ATTRIBUTES
None
-
+### OPTIONAL ATTRIBUTES
+- TSK_PHOTODNA_HASH (The PhotoDNA hash of an image)
---
## TSK_GPS_BOOKMARK
@@ -529,7 +530,8 @@ Indicates recently accessed content. Examples: Recent Documents or Recent Downlo
- TSK_PROG_NAME (Application or application extractor that stored this object as recent)
- TSK_DATETIME (A timestamp associated with the content, in seconds since 1970-01-01T00:00:00Z. Ex: creation time)
- TSK_NAME (If found in the registry, the name of the attribute)
-- TSK_VALUE(If found in the registry, the value of the attribute)
+- TSK_VALUE (If found in the registry, the value of the attribute)
+- TSK_COMMENT (What the source of the attribute may be)
diff --git a/bindings/java/src/org/sleuthkit/datamodel/BlackboardAttribute.java b/bindings/java/src/org/sleuthkit/datamodel/BlackboardAttribute.java
index 50acb9f053c37a600ba5d0f97d90a880e0be0239..396d5ab3b20077a600fd0fbc586d27a2a67d1253 100755
--- a/bindings/java/src/org/sleuthkit/datamodel/BlackboardAttribute.java
+++ b/bindings/java/src/org/sleuthkit/datamodel/BlackboardAttribute.java
@@ -1387,7 +1387,11 @@ public enum ATTRIBUTE_TYPE {
TSK_DISTANCE_FROM_HOMEPOINT(145, "TSK_DISTANCE_FROM_HOMEPOINT",
bundle.getString("BlackboardAttribute.tskdistancefromhome.text"),
- TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DOUBLE)
+ TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DOUBLE),
+
+ TSK_HASH_PHOTODNA(146, "TSK_HASH_PHOTODNA",
+ bundle.getString("BlackboardAttribute.tskhashphotodna.text"),
+ TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING)
;
diff --git a/bindings/java/src/org/sleuthkit/datamodel/Bundle.properties b/bindings/java/src/org/sleuthkit/datamodel/Bundle.properties
index 9e394b7b087591ad22746995fcb8e1bb6a4afd5f..c3728bb03f347f12a1e92bee77d64d6f1c2987da 100644
--- a/bindings/java/src/org/sleuthkit/datamodel/Bundle.properties
+++ b/bindings/java/src/org/sleuthkit/datamodel/Bundle.properties
@@ -195,6 +195,7 @@ BlackboardAttribute.tskgeopath.text=List of Track Points
BlackboardAttribute.tskgeowaypoints.text=List of Waypoints
BlackboardAttribute.tskdistancetraveled.text=Distance Traveled
BlackboardAttribute.tskdistancefromhome.text=Distance from Homepoint
+BlackboardAttribute.tskhashphotodna.text=PhotoDNA Hash
AbstractFile.readLocal.exception.msg4.text=Error reading local file\: {0}
AbstractFile.readLocal.exception.msg1.text=Error reading local file, local path is not set
AbstractFile.readLocal.exception.msg2.text=Error reading local file, it does not exist at local path\: {0}
diff --git a/licenses/bsd.txt b/licenses/bsd.txt
new file mode 100644
index 0000000000000000000000000000000000000000..ffb82a69aa34be508b5cba51e4b2219b267e43f2
--- /dev/null
+++ b/licenses/bsd.txt
@@ -0,0 +1,16 @@
+The following files use the 3-Clause BSD license:
+
+tsk/fs/lzvn.c
+Copyright (c) 2015-2016, Apple Inc. All rights reserved.
+
+
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder(s) nor the names of any contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
\ No newline at end of file
diff --git a/licenses/mit.txt b/licenses/mit.txt
new file mode 100644
index 0000000000000000000000000000000000000000..527c48ea76b56af6f87b7007164864316ec1d885
--- /dev/null
+++ b/licenses/mit.txt
@@ -0,0 +1,24 @@
+The following files use the MIT license:
+
+tsk/auto/guid.cpp
+Copyright (c) 2014 Graeme Hill (http://graemehill.ca)
+
+
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
\ No newline at end of file
diff --git a/tsk/docs/hashdb.dox b/tsk/docs/hashdb.dox
index b28400f5f16c701da79659e29d558259a107f5c8..0d7166979536c68ef94b9f63162c4d1f42511aae 100644
--- a/tsk/docs/hashdb.dox
+++ b/tsk/docs/hashdb.dox
@@ -4,7 +4,7 @@ This section describes some the API functions and concepts associated with the H
\section hash_over Overview
-Hash databases are frequently used to identify known good and known bad files. Text files of MD5 and SHA-1 hashes can be easily created and shared, but they are frequently not the most efficient to use to use when searching for a hash because they are in an unsorted order.
+Hash databases are frequently used to identify known good and known bad files. Text files of MD5 and SHA-1 hashes can be easily created and shared, but they are frequently not the most efficient to use when searching for a hash because they are in an unsorted order.
The hash database functions in TSK create an index into text file hash databases and allow you to more quickly perform lookups. TSK uses the index to perform binary searches for the hashes (see <a href="http://www.sleuthkit.org/informer/sleuthkit-informer-6.html">Informer #6</a>).
diff --git a/tsk/fs/fs_types.c b/tsk/fs/fs_types.c
index 6ba88f0e6f1e1065fbdedb93fe4b512c4155f334..eef6b4fae4c43afbcf978a6198b49586991a54f8 100644
--- a/tsk/fs/fs_types.c
+++ b/tsk/fs/fs_types.c
@@ -39,16 +39,18 @@ typedef struct {
* name so that we can map between values and names.
*/
static FS_TYPES fs_type_table[] = {
- {"ntfs", TSK_FS_TYPE_NTFS_DETECT, "NTFS"},
+ {"ntfs", TSK_FS_TYPE_NTFS, "NTFS"}, // NTFS == NTFS_DETECT
{"fat", TSK_FS_TYPE_FAT_DETECT, "FAT (Auto Detection)"},
{"ext", TSK_FS_TYPE_EXT_DETECT, "ExtX (Auto Detection)"},
- {"iso9660", TSK_FS_TYPE_ISO9660_DETECT, "ISO9660 CD"},
+ {"iso9660", TSK_FS_TYPE_ISO9660, "ISO9660 CD"}, // ISO9660 == DETECT
#if TSK_USE_HFS
- {"hfs", TSK_FS_TYPE_HFS_DETECT, "HFS+"},
+ {"hfs", TSK_FS_TYPE_HFS_DETECT, "HFS+ (Auto Detection)"},
#endif
+ {"yaffs2", TSK_FS_TYPE_YAFFS2, "YAFFS2"},
+ {"apfs", TSK_FS_TYPE_APFS, "APFS"},
{"ufs", TSK_FS_TYPE_FFS_DETECT, "UFS (Auto Detection)"},
- {"raw", TSK_FS_TYPE_RAW_DETECT, "Raw Data"},
- {"swap", TSK_FS_TYPE_SWAP_DETECT, "Swap Space"},
+ {"raw", TSK_FS_TYPE_RAW, "Raw Data"}, // RAW == RAW_DETECT
+ {"swap", TSK_FS_TYPE_SWAP, "Swap Space"}, // SWAP == SWAP_DETECT
{"fat12", TSK_FS_TYPE_FAT12, "FAT12"},
{"fat16", TSK_FS_TYPE_FAT16, "FAT16"},
{"fat32", TSK_FS_TYPE_FAT32, "FAT32"},
@@ -58,8 +60,10 @@ static FS_TYPES fs_type_table[] = {
{"ext4", TSK_FS_TYPE_EXT4, "Ext4"},
{"ufs1", TSK_FS_TYPE_FFS1, "UFS1"},
{"ufs2", TSK_FS_TYPE_FFS2, "UFS2"},
- {"yaffs2", TSK_FS_TYPE_YAFFS2, "YAFFS2"},
- {"apfs", TSK_FS_TYPE_APFS, "APFS"},
+#if TSK_USE_HFS
+ {"hfsp", TSK_FS_TYPE_HFS, "HFS+"},
+ {"hfsl", TSK_FS_TYPE_HFS_LEGACY, "HFS (Legacy)"},
+#endif
{0,0,""},
};
diff --git a/tsk/fs/ntfs.c b/tsk/fs/ntfs.c
index eeff809ef191244e4bb974dcbe9793ca518888ce..c55ee59f71eb1a565c49c8f8f7d4e0b7ca1a4696 100755
--- a/tsk/fs/ntfs.c
+++ b/tsk/fs/ntfs.c
@@ -375,7 +375,9 @@ ntfs_dinode_lookup(NTFS_INFO * a_ntfs, char *a_buf, TSK_INUM_T a_mftnum)
("dinode_lookup: More Update Sequence Entries than MFT size");
return TSK_COR;
}
- if (tsk_getu16(fs->endian, mft->upd_off) + sizeof(ntfs_upd) > a_ntfs->mft_rsize_b) {
+ if (tsk_getu16(fs->endian, mft->upd_off) +
+ sizeof(ntfs_upd) +
+ 2*(tsk_getu16(fs->endian, mft->upd_cnt) - 1) > a_ntfs->mft_rsize_b) {
tsk_error_reset();
tsk_error_set_errno(TSK_ERR_FS_INODE_COR);
tsk_error_set_errstr