Skip to content
GitLab
Explore
Sign in
Primary navigation
Search or go to…
Project
S
Sleuthkit
Manage
Activity
Members
Labels
Plan
Issues
Issue boards
Milestones
Iterations
Requirements
Code
Merge requests
Repository
Branches
Commits
Tags
Repository graph
Compare revisions
Snippets
Locked files
Build
Pipelines
Jobs
Pipeline schedules
Test cases
Artifacts
Deploy
Releases
Package registry
Model registry
Operate
Environments
Terraform modules
Monitor
Incidents
Analyze
Value stream analytics
Contributor analytics
CI/CD analytics
Repository analytics
Code review analytics
Issue analytics
Insights
Model experiments
Help
Help
Support
GitLab documentation
Compare GitLab plans
Community forum
Contribute to GitLab
Provide feedback
Terms and privacy
Keyboard shortcuts
?
Snippets
Groups
Projects
Show more breadcrumbs
IRT
Sleuthkit
Commits
dc30727d
Commit
dc30727d
authored
15 years ago
by
Brian Carrier
Browse files
Options
Downloads
Patches
Plain Diff
partial fix for 2840345 re: META tag for extended partitions
parent
f1de9a71
No related branches found
No related tags found
No related merge requests found
Changes
3
Hide whitespace changes
Inline
Side-by-side
Showing
3 changed files
CHANGES.txt
+2
-0
2 additions, 0 deletions
CHANGES.txt
man/mmls.1
+12
-8
12 additions, 8 deletions
man/mmls.1
tsk3/vs/dos.c
+1
-1
1 addition, 1 deletion
tsk3/vs/dos.c
with
15 additions
and
9 deletions
CHANGES.txt
+
2
−
0
View file @
dc30727d
...
@@ -98,6 +98,8 @@ to sigfind.
...
@@ -98,6 +98,8 @@ to sigfind.
7/21/09: Update: Resolved Feature request 2206331 re: indirect blocks
7/21/09: Update: Resolved Feature request 2206331 re: indirect blocks
in UFS/Ext2.
in UFS/Ext2.
8/19/09: Bug Fix: Fixed part of 2840345 where extended DOS partitions
in extended partitions were not marked as Meta.
---------------- VERSION 3.0.1 --------------
---------------- VERSION 3.0.1 --------------
11/11/08: Bug Fix: Fixed crashing bug in ifind on FAT file system.
11/11/08: Bug Fix: Fixed crashing bug in ifind on FAT file system.
...
...
This diff is collapsed.
Click to expand it.
man/mmls.1
+
12
−
8
View file @
dc30727d
...
@@ -54,14 +54,18 @@ Lastly, it works on non-Linux systems.
...
@@ -54,14 +54,18 @@ Lastly, it works on non-Linux systems.
If none of -a, -A, -m, or -M are given then all volume types will
If none of -a, -A, -m, or -M are given then all volume types will
be listed. If any of them are given, then only the types specified
be listed. If any of them are given, then only the types specified
on the command line will be listed. Allocated volumes are those
on the command line will be listed.
that are listed in a partition table in the volume system. Unallocated
volumes are virtually created by mmls to show you which sectors
Allocated volumes are those that are listed in a partition table
have not been allocated to a volume. The metadata volumes overlap
in the volume system AND can store data. Unallocated volumes are
the allocated and unallocated volumes and describe where the partition
virtually created by mmls to show you which sectors have not been
tables and other metadata structures are located. In some volume
allocated to a volume. The metadata volumes overlap the allocated
systems, these structures are in allocated space and in others they
and unallocated volumes and describe where the partition tables and
are in unallocated space. They can be hidden with -M.
other metadata structures are located. In some volume systems,
these structures are in allocated space and in others they are in
unallocated space. In some volume systems, their location is
explicitly given in the partition tables and in others they are
not.
.SH "EXAMPLES"
.SH "EXAMPLES"
To list the partition table of a Windows system using autodetect:
To list the partition table of a Windows system using autodetect:
...
...
This diff is collapsed.
Click to expand it.
tsk3/vs/dos.c
+
1
−
1
View file @
dc30727d
...
@@ -763,7 +763,7 @@ dos_load_ext_table(TSK_VS_INFO * vs, TSK_DADDR_T sect_cur,
...
@@ -763,7 +763,7 @@ dos_load_ext_table(TSK_VS_INFO * vs, TSK_DADDR_T sect_cur,
if
(
NULL
==
tsk_vs_part_add
(
vs
,
if
(
NULL
==
tsk_vs_part_add
(
vs
,
(
TSK_DADDR_T
)
(
sect_ext_base
+
part_start
),
(
TSK_DADDR_T
)
(
sect_ext_base
+
part_start
),
(
TSK_DADDR_T
)
part_size
,
TSK_VS_PART_FLAG_
ALLOC
,
(
TSK_DADDR_T
)
part_size
,
TSK_VS_PART_FLAG_
META
,
dos_get_desc
(
part
->
ptype
),
table
,
i
))
dos_get_desc
(
part
->
ptype
),
table
,
i
))
return
1
;
return
1
;
...
...
This diff is collapsed.
Click to expand it.
Preview
0%
Loading
Try again
or
attach a new file
.
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Save comment
Cancel
Please
register
or
sign in
to comment