diff --git a/tsk/auto/auto_db.cpp b/tsk/auto/auto_db.cpp index 539c9f7f4561ac60c30775bda9b875bac8b6b0ad..da9dac20b4d247855e6bfca63a475b3a99daf8f8 100644 --- a/tsk/auto/auto_db.cpp +++ b/tsk/auto/auto_db.cpp @@ -881,6 +881,8 @@ TskAutoDb::md5HashAttr(unsigned char md5Hash[16], const TSK_FS_ATTR * fs_attr) TSK_WALK_RET_ENUM TskAutoDb::fsWalkUnallocBlocksCb(const TSK_FS_BLOCK *a_block, void *a_ptr) { UNALLOC_BLOCK_WLK_TRACK * unallocBlockWlkTrack = (UNALLOC_BLOCK_WLK_TRACK *) a_ptr; + int MAX_CHUNK_SIZE = 2.5*1024*1024*1024; //2.5GB + if (unallocBlockWlkTrack->tskAutoDb.m_stopAllProcessing) return TSK_WALK_STOP; @@ -895,8 +897,9 @@ TSK_WALK_RET_ENUM TskAutoDb::fsWalkUnallocBlocksCb(const TSK_FS_BLOCK *a_block, } // if this block is consecutive with the previous one, update prevBlock and return - if (a_block->addr == unallocBlockWlkTrack->prevBlock + 1) { + if ((a_block->addr == unallocBlockWlkTrack->prevBlock + 1) && (unallocBlockWlkTrack->size < MAX_CHUNK_SIZE)) { unallocBlockWlkTrack->prevBlock = a_block->addr; + unallocBlockWlkTrack->size += unallocBlockWlkTrack->fsInfo.block_size; return TSK_WALK_CONT; } @@ -908,7 +911,7 @@ TSK_WALK_RET_ENUM TskAutoDb::fsWalkUnallocBlocksCb(const TSK_FS_BLOCK *a_block, unallocBlockWlkTrack->ranges.push_back(TSK_DB_FILE_LAYOUT_RANGE(rangeStartOffset, rangeSizeBytes, unallocBlockWlkTrack->nextSequenceNo++)); // bookkeeping for the next range object - unallocBlockWlkTrack->size += rangeSizeBytes; + //unallocBlockWlkTrack->size += rangeSizeBytes; unallocBlockWlkTrack->curRangeStart = a_block->addr; unallocBlockWlkTrack->prevBlock = a_block->addr; @@ -918,6 +921,7 @@ TSK_WALK_RET_ENUM TskAutoDb::fsWalkUnallocBlocksCb(const TSK_FS_BLOCK *a_block, if ((unallocBlockWlkTrack->chunkSize == 0) || ((unallocBlockWlkTrack->chunkSize > 0) && (unallocBlockWlkTrack->size < unallocBlockWlkTrack->chunkSize))) { + unallocBlockWlkTrack->size += unallocBlockWlkTrack->fsInfo.block_size; return TSK_WALK_CONT; }