diff --git a/tsk/auto/auto_db.cpp b/tsk/auto/auto_db.cpp
index 310b965787ba9eac24fb921e88fd0fb59bf34e75..b2de68aeafc10833036d75998bb330c290ca7f06 100644
--- a/tsk/auto/auto_db.cpp
+++ b/tsk/auto/auto_db.cpp
@@ -342,25 +342,6 @@ TSK_RETVAL_ENUM
const unsigned char *const md5,
const TSK_DB_FILES_KNOWN_ENUM known)
{
- printf("\n");
- if((fs_file->name != NULL) && (fs_file->name->name != NULL)){
- printf("File: %s\n", fs_file->name->name);
- }else {
- printf("File: <unknown>\n");
- }
- if(fs_attr != NULL){
- printf(" Size: %d\n", fs_file->meta->size);
- printf(" Alloc size: %d\n", fs_attr->nrd.allocsize);
- printf(" Comp size: %d\n", fs_attr->nrd.compsize);
- printf(" Init size: %d\n", fs_attr->nrd.initsize);
- printf(" Runs:\n");
- TSK_FS_ATTR_RUN * run = fs_attr->nrd.run;
- while(run != fs_attr->nrd.run_end){
- printf(" %d, length %d\n", run->addr, run->len);
- run = run->next;
- }
- }
-
if (m_db->addFsFile(fs_file, fs_attr, path, md5, known, m_curFsId, m_curFileId,
m_curImgId)) {
@@ -368,103 +349,6 @@ TSK_RETVAL_ENUM
return TSK_ERR;
}
- //return insertSlackFileData(fs_file, fs_attr, path, md5, known);
- return TSK_OK;
-}
-
-TSK_RETVAL_ENUM
- TskAutoDb::insertSlackFileData(TSK_FS_FILE * fs_file,
- const TSK_FS_ATTR * fs_attr, const char *path,
- const unsigned char *const md5,
- const TSK_DB_FILES_KNOWN_ENUM known)
-{
- // Should do check that file name does not already end in "-slack". Or maybe can just test for type somehow later
- int name_length;
- TSK_FS_NAME* slack_name;
- TSK_FS_NAME* orig_name;
-
- if((fs_file->name == NULL) || (fs_file->name->name == NULL) ||
- (fs_file->meta == NULL)){
- printf("Null name, name->name, or meta\n");
- }
- else {
- printf("fs_file: %s\n size: %d\n content len: %d\n", fs_file->name->name, fs_file->meta->size,
- fs_file->meta->content_len);
- }
-
- if(fs_file->meta == NULL){
- printf(" fs_file->meta is null, giving up\n");
- return TSK_OK;
- }
- printf(" type: %x\n", fs_file->meta->type);
- if(fs_file->meta->type != TSK_FS_META_TYPE_REG){
- printf(" Not a file\n");
- return TSK_OK;
- }
- if(fs_file->name == NULL){
- printf(" fs_file->name is null! giving up\n");
- return TSK_OK;
- }
-
- if(fs_file->name->name == NULL){
- printf(" fs_file->name->name is null! giving up\n");
- return TSK_OK;
- }
-
- if(fs_file->meta->attr_state == TSK_FS_META_ATTR_STUDIED){
- printf(" attr_state is studied\n");
- TSK_FS_ATTR *fs_attr_cur;
- for (fs_attr_cur = fs_file->meta->attr->head; fs_attr_cur;fs_attr_cur = fs_attr_cur->next) {
- printf(" attr name: %s\n", fs_attr_cur->name);
- printf(" flags: %x (non-resident: %x)", fs_attr_cur->flags, fs_attr_cur->flags & TSK_FS_ATTR_NONRES);
- printf(" attr type: %x\n", fs_attr_cur->type);
- printf(" alloc: 0x%llx\n", fs_attr_cur->nrd.allocsize);
- printf(" size: 0x%llx\n", fs_attr_cur->size);
-
- }
-
- }
- else {
- printf(" attr_state is not studied\n");
- }
-
- // Ok we're good to go.
- //TSK_FS_FILE * slack_file = tsk_fs_file_alloc(fs_file->fs_info);
-
- // Allocate the new name structure
- name_length = strlen(fs_file->name->name) + 6;
- if ((slack_name = tsk_fs_name_alloc(name_length, 32)) == NULL) {
- return TSK_ERR;
- }
-
- if(tsk_fs_name_copy(slack_name, fs_file->name)){
- tsk_fs_name_free(slack_name);
- return TSK_ERR;
- }
-
- // The name copy could end up resizing the array. It currently allocates an extra 16 bytes but we shouldn't count on that.
- if(slack_name->name_size < name_length){
- tsk_fs_name_realloc(slack_name, name_length);
- }
-
- // Add the "-slack"
- strncat(slack_name->name, "-slack", 6);
-
- printf(" Trying to add fs_file %s with metadata addr %x\n", slack_name->name, fs_file->meta->addr);
-
- // Swap in the new name block and re-add the file
- orig_name = fs_file->name;
- fs_file->name = slack_name;
- if (m_db->addFsFile(fs_file, fs_attr, path, md5, known, m_curFsId, m_curFileId,
- m_curImgId)) {
- fs_file->name = orig_name;
- tsk_fs_name_free(slack_name);
- registerError();
- return TSK_ERR;
- }
- fs_file->name = orig_name;
- tsk_fs_name_free(slack_name);
-
return TSK_OK;
}
diff --git a/tsk/auto/db_postgresql.cpp b/tsk/auto/db_postgresql.cpp
index 8aea50ba4bb656a787d98da7a6a6db392c55b9bf..f396ab73100de78fa5a6afa3850f0a1244351754 100755
--- a/tsk/auto/db_postgresql.cpp
+++ b/tsk/auto/db_postgresql.cpp
@@ -1057,10 +1057,15 @@ int TskDbPostgreSQL::addFile(TSK_FS_FILE * fs_file, const TSK_FS_ATTR * fs_attr,
return 1;
}
- // Add entry for the slack space if applicable
+ // Add entry for the slack space.
+ // Current conditions for creating a slack file:
+ // - Data is non-resident
+ // - The allocated size is greater than the file size
+ // - The data is not compressed
if((fs_attr != NULL)
+ && (! (fs_file->meta->flags & TSK_FS_META_FLAG_COMP))
&& (fs_attr->flags & TSK_FS_ATTR_NONRES)
- && (fs_attr->nrd.allocsize != fs_attr->size)){
+ && (fs_attr->nrd.allocsize > fs_attr->size)){
strncat(name, "-slack", 6);
name_sql = PQescapeLiteral(conn, name, strlen(name));
TSK_OFF_T slackSize = fs_attr->nrd.allocsize - fs_attr->size;
diff --git a/tsk/auto/db_sqlite.cpp b/tsk/auto/db_sqlite.cpp
index 12bb9349202c72322aefff404abe6cc23d0edf15..8f4ed1b0e8b53715d6d7e2df80a61f25a857cf46 100755
--- a/tsk/auto/db_sqlite.cpp
+++ b/tsk/auto/db_sqlite.cpp
@@ -991,10 +991,15 @@ int
return 1;
}
- // Add entry for the slack space if applicable
+ // Add entry for the slack space.
+ // Current conditions for creating a slack file:
+ // - Data is non-resident
+ // - The allocated size is greater than the file size
+ // - The data is not compressed
if((fs_attr != NULL)
+ && (!(fs_file->meta->flags & TSK_FS_META_FLAG_COMP))
&& (fs_attr->flags & TSK_FS_ATTR_NONRES)
- && (fs_attr->nrd.allocsize != fs_attr->size)){
+ && (fs_attr->nrd.allocsize > fs_attr->size)){
strncat(name, "-slack", 6);
TSK_OFF_T slackSize = fs_attr->nrd.allocsize - fs_attr->size;