From dc30727d7038ebed88f76acec8245775272dcc7f Mon Sep 17 00:00:00 2001
From: Brian Carrier <carrier@sleuthkit.org>
Date: Wed, 19 Aug 2009 14:44:03 +0000
Subject: [PATCH] partial fix for 2840345 re: META tag for extended partitions
---
CHANGES.txt | 2 ++
man/mmls.1 | 20 ++++++++++++--------
tsk3/vs/dos.c | 2 +-
3 files changed, 15 insertions(+), 9 deletions(-)
diff --git a/CHANGES.txt b/CHANGES.txt
index dd140addb..ed9a7eb76 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -98,6 +98,8 @@ to sigfind.
7/21/09: Update: Resolved Feature request 2206331 re: indirect blocks
in UFS/Ext2.
+8/19/09: Bug Fix: Fixed part of 2840345 where extended DOS partitions
+in extended partitions were not marked as Meta.
---------------- VERSION 3.0.1 --------------
11/11/08: Bug Fix: Fixed crashing bug in ifind on FAT file system.
diff --git a/man/mmls.1 b/man/mmls.1
index bcef8759b..321fe3769 100644
--- a/man/mmls.1
+++ b/man/mmls.1
@@ -54,14 +54,18 @@ Lastly, it works on non-Linux systems.
If none of -a, -A, -m, or -M are given then all volume types will
be listed. If any of them are given, then only the types specified
-on the command line will be listed. Allocated volumes are those
-that are listed in a partition table in the volume system. Unallocated
-volumes are virtually created by mmls to show you which sectors
-have not been allocated to a volume. The metadata volumes overlap
-the allocated and unallocated volumes and describe where the partition
-tables and other metadata structures are located. In some volume
-systems, these structures are in allocated space and in others they
-are in unallocated space. They can be hidden with -M.
+on the command line will be listed.
+
+Allocated volumes are those that are listed in a partition table
+in the volume system AND can store data. Unallocated volumes are
+virtually created by mmls to show you which sectors have not been
+allocated to a volume. The metadata volumes overlap the allocated
+and unallocated volumes and describe where the partition tables and
+other metadata structures are located. In some volume systems,
+these structures are in allocated space and in others they are in
+unallocated space. In some volume systems, their location is
+explicitly given in the partition tables and in others they are
+not.
.SH "EXAMPLES"
To list the partition table of a Windows system using autodetect:
diff --git a/tsk3/vs/dos.c b/tsk3/vs/dos.c
index a9129bec4..4aa31b98e 100644
--- a/tsk3/vs/dos.c
+++ b/tsk3/vs/dos.c
@@ -763,7 +763,7 @@ dos_load_ext_table(TSK_VS_INFO * vs, TSK_DADDR_T sect_cur,
if (NULL == tsk_vs_part_add(vs,
(TSK_DADDR_T) (sect_ext_base + part_start),
- (TSK_DADDR_T) part_size, TSK_VS_PART_FLAG_ALLOC,
+ (TSK_DADDR_T) part_size, TSK_VS_PART_FLAG_META,
dos_get_desc(part->ptype), table, i))
return 1;
--
GitLab