Modified TskCaseDb and TskAutoDb classes to use TskDb instead of TskDbSqlite

tsk/auto/auto_db.cpp

@@ -30,7 +30,7 @@ using std::for_each;
  * @param a_NSRLDb Database of "known" files (can be NULL)
  * @param a_knownBadDb Database of "known bad" files (can be NULL)
  */
-TskAutoDb::TskAutoDb(TskDbSqlite * a_db, TSK_HDB_INFO * a_NSRLDb, TSK_HDB_INFO * a_knownBadDb)
+TskAutoDb::TskAutoDb(TskDb * a_db, TSK_HDB_INFO * a_NSRLDb, TSK_HDB_INFO * a_knownBadDb)
 {
     m_db = a_db;
     m_curImgId = 0;

tsk/auto/case_db.cpp

@@ -17,7 +17,7 @@
 #include "tsk_case_db.h"
 #include "tsk_auto_i.h"
 
-TskCaseDb::TskCaseDb(TskDbSqlite * a_db)
+TskCaseDb::TskCaseDb(TskDb * a_db)
 {
     m_tag = TSK_CASE_DB_TAG;
     m_db = a_db;
@@ -65,7 +65,7 @@ TskCaseDb::newDb(const TSK_TCHAR * const path)
         return NULL;
     }
 
-    TskDbSqlite *db = new TskDbSqlite(path, true);
+    TskDb *db = new TskDbSqlite(path, true);
 
     // Open the database.
     if (db->open(true)) {
@@ -95,7 +95,7 @@ TskCaseDb::openDb(const TSK_TCHAR * path)
         return NULL;
     }
 
-    TskDbSqlite *db = new TskDbSqlite(path, true);
+    TskDb *db = new TskDbSqlite(path, true);
 
     // Open the database.
     if (db->open(false)) {

tsk/auto/db_sqlite.cpp

@@ -17,7 +17,6 @@
 #include "sqlite3.h"
 
 #include <string.h>
-
 #include <sstream>
 #include <algorithm>
 
@@ -32,6 +31,7 @@ using std::for_each;
 * open() before the object can be used.
 */
 TskDbSqlite::TskDbSqlite(const char *a_dbFilePathUtf8, bool a_blkMapFlag)
+    : TskDb(a_dbFilePathUtf8, a_blkMapFlag)
 {
     strncpy(m_dbFilePathUtf8, a_dbFilePathUtf8, 1024);
     m_utf8 = true;
@@ -44,6 +44,7 @@ TskDbSqlite::TskDbSqlite(const char *a_dbFilePathUtf8, bool a_blkMapFlag)
 #ifdef TSK_WIN32
 //@@@@
 TskDbSqlite::TskDbSqlite(const TSK_TCHAR * a_dbFilePath, bool a_blkMapFlag)
+    : TskDb(a_dbFilePath, a_blkMapFlag)
 {
     wcsncpy(m_dbFilePath, a_dbFilePath, 1024);
     m_utf8 = false;

tsk/auto/tsk_case_db.h

@@ -33,7 +33,7 @@ using std::string;
  */
 class TskAutoDb:public TskAuto {
   public:
-    TskAutoDb(TskDbSqlite * a_db, TSK_HDB_INFO * a_NSRLDb, TSK_HDB_INFO * a_knownBadDb);
+    TskAutoDb(TskDb * a_db, TSK_HDB_INFO * a_NSRLDb, TSK_HDB_INFO * a_knownBadDb);
     virtual ~ TskAutoDb();
     virtual uint8_t openImage(int, const TSK_TCHAR * const images[],
         TSK_IMG_TYPE_ENUM, unsigned int a_ssize);
@@ -94,7 +94,7 @@ class TskAutoDb:public TskAuto {
     int64_t commitAddImage();
 
   private:
-    TskDbSqlite * m_db;
+    TskDb * m_db;
     int64_t m_curImgId;     ///< Object ID of image currently being processed
     int64_t m_curVsId;      ///< Object ID of volume system currently being processed
     int64_t m_curVolId;     ///< Object ID of volume currently being processed
@@ -187,8 +187,8 @@ class TskCaseDb {
     TskCaseDb(const TskCaseDb&);
     TskCaseDb & operator=(const TskCaseDb&);
 
-    TskCaseDb(TskDbSqlite * a_db);
-    TskDbSqlite *m_db;
+    TskCaseDb(TskDb * a_db);
+    TskDb *m_db;
     TSK_HDB_INFO * m_NSRLDb;
     TSK_HDB_INFO * m_knownBadDb;
 };

tsk/auto/tsk_db.cpp

+/*
+** The Sleuth Kit
+**
+** Brian Carrier [carrier <at> sleuthkit [dot] org]
+** Copyright (c) 2010-2013 Brian Carrier.  All Rights reserved
+**
+** This software is distributed under the Common Public License 1.0
+**
+*/
+
+/**
+* \file tsk_db.cpp
+* Contains code related to abstract TSK database handling class. 
+*/
+
+#include "tsk_db.h"
+
+/**
+* Set the locations and logging object.  Must call
+* open() before the object can be used.
+*/
+TskDb::TskDb(const char *a_dbFilePathUtf8, bool a_blkMapFlag)
+{
+
+}
+
+#ifdef TSK_WIN32
+//@@@@
+TskDb::TskDb(const TSK_TCHAR * a_dbFilePath, bool a_blkMapFlag)
+{
+
+}
+#endif
+

tsk/auto/tsk_db.h

+/*
+ ** The Sleuth Kit 
+ **
+ ** Brian Carrier [carrier <at> sleuthkit [dot] org]
+ ** Copyright (c) 2011-2012 Brian Carrier.  All Rights reserved
+ **
+ ** This software is distributed under the Common Public License 1.0
+ **
+ */
+
+/**
+ * \file tsk_db.h
+ * Contains TSK interface to abstract database handling class. The intent of this class
+ * is so that different databases can be seamlesly used by TSK. 
+ */
+
+#ifndef _TSK_DB_H
+#define _TSK_DB_H
+
+#include <vector>
+#include <string>
+#include <ostream>
+
+#include "tsk_auto_i.h"
+
+using std::ostream;
+using std::vector;
+using std::string;
+
+/**
+ * Values for the type column in the tsk_objects table. 
+ */
+typedef enum {
+    TSK_DB_OBJECT_TYPE_IMG = 0, ///< Object is a disk image
+    TSK_DB_OBJECT_TYPE_VS,      ///< Object is a volume system. 
+    TSK_DB_OBJECT_TYPE_VOL,     ///< Object is a volume 
+    TSK_DB_OBJECT_TYPE_FS,      ///< Object is a file system
+    TSK_DB_OBJECT_TYPE_FILE,    ///< Object is a file (exact type can be determined in the tsk_files table via TSK_DB_FILES_TYPE_ENUM)
+} TSK_DB_OBJECT_TYPE_ENUM;
+
+/**
+ * Values for the files type column in the tsk_files table.
+ */
+typedef enum {
+    TSK_DB_FILES_TYPE_FS = 0,   ///< File that can be found in file system tree. 
+    TSK_DB_FILES_TYPE_CARVED,   ///< Set of blocks for a file found from carving.  Could be on top of a TSK_DB_FILES_TYPE_UNALLOC_BLOCKS range. 
+    TSK_DB_FILES_TYPE_DERIVED,  ///< File derived from a parent file (i.e. from ZIP)
+    TSK_DB_FILES_TYPE_LOCAL,    ///< Local file that was added (not from a disk image)
+    TSK_DB_FILES_TYPE_UNALLOC_BLOCKS,   ///< Set of blocks not allocated by file system.  Parent should be image, volume, or file system.  Many columns in tsk_files will be NULL. Set layout in tsk_file_layout. 
+    TSK_DB_FILES_TYPE_UNUSED_BLOCKS, ///< Set of blocks that are unallocated AND not used by a carved or other file type.  Parent should be UNALLOC_BLOCKS, many columns in tsk_files will be NULL, set layout in tsk_file_layout. 
+    TSK_DB_FILES_TYPE_VIRTUAL_DIR, ///< Virtual directory (not on fs) with no meta-data entry that can be used to group files of types other than TSK_DB_FILES_TYPE_FS. Its parent is either another TSK_DB_FILES_TYPE_FS or a root directory or type TSK_DB_FILES_TYPE_FS.
+} TSK_DB_FILES_TYPE_ENUM;
+
+
+
+/**
+* Values for the "known" column of the tsk_files table
+*/
+typedef enum  {
+    TSK_DB_FILES_KNOWN_UNKNOWN = 0,  ///< Not matched against an index
+    TSK_DB_FILES_KNOWN_KNOWN = 1,    ///< Match found in a "known" file index (such as NIST NSRL)and could be good or bad.  
+    TSK_DB_FILES_KNOWN_KNOWN_BAD = 2,      ///< Match found in a "known bad" index
+    TSK_DB_FILES_KNOWN_KNOWN_GOOD = 3,      ///< Match found in a "known good" index
+} TSK_DB_FILES_KNOWN_ENUM;
+
+
+/**
+* Structure wrapping a single tsk objects db entry
+*/
+typedef struct _TSK_DB_OBJECT {
+    int64_t objId; ///< set to 0 if unknown (before it becomes a db object)
+    int64_t parObjId;
+    TSK_DB_OBJECT_TYPE_ENUM type;    
+} TSK_DB_OBJECT;
+
+ostream& operator <<(ostream &os,const TSK_DB_OBJECT &dbObject);
+
+/**
+* Structure wrapping a single file_layout db entry
+*/
+typedef struct _TSK_DB_FILE_LAYOUT_RANGE {
+    //default constructor
+    _TSK_DB_FILE_LAYOUT_RANGE()
+        : fileObjId(0),byteStart(0),byteLen(0),sequence(0) {}
+    //constructor for non-db object (before it becomes one)
+    _TSK_DB_FILE_LAYOUT_RANGE(uint64_t byteStart, uint64_t byteLen, int sequence)
+        : fileObjId(0),byteStart(byteStart),byteLen(byteLen),sequence(sequence) {}
+ 
+    int64_t fileObjId; ///< set to 0 if unknown (before it becomes a db object)
+    uint64_t byteStart;
+    uint64_t byteLen;
+    int sequence;
+
+    //default comparator by sequence
+    bool operator< (const struct _TSK_DB_FILE_LAYOUT_RANGE & rhs) const
+    { return sequence < rhs.sequence; }
+
+} TSK_DB_FILE_LAYOUT_RANGE;
+
+ostream& operator <<(ostream &os,const TSK_DB_FILE_LAYOUT_RANGE &layoutRange);
+
+/**
+* Structure wrapping a single fs info db entry
+*/
+typedef struct _TSK_DB_FS_INFO {
+    int64_t objId; ///< set to 0 if unknown (before it becomes a db object)
+    TSK_OFF_T imgOffset;
+    TSK_FS_TYPE_ENUM fType;
+    unsigned int block_size;
+    TSK_DADDR_T block_count;
+    TSK_INUM_T root_inum;
+    TSK_INUM_T first_inum;
+    TSK_INUM_T last_inum;     
+} TSK_DB_FS_INFO;
+
+ostream& operator <<(ostream &os,const TSK_DB_FS_INFO &fsInfo);
+
+
+/**
+* Structure wrapping a single vs info db entry
+*/
+typedef struct _TSK_DB_VS_INFO {
+    int64_t objId; ///< set to 0 if unknown (before it becomes a db object)
+    TSK_VS_TYPE_ENUM vstype;
+    TSK_DADDR_T offset;
+    unsigned int block_size;  
+} TSK_DB_VS_INFO;
+
+ostream& operator <<(ostream &os,const TSK_DB_VS_INFO &vsInfo);
+
+/**
+* Structure wrapping a single vs part db entry
+*/
+#define TSK_MAX_DB_VS_PART_INFO_DESC_LEN 512
+typedef struct _TSK_DB_VS_PART_INFO {
+    int64_t objId; ///< set to 0 if unknown (before it becomes a db object)
+    TSK_PNUM_T addr;
+    TSK_DADDR_T start;
+    TSK_DADDR_T len;
+    char desc[TSK_MAX_DB_VS_PART_INFO_DESC_LEN];
+    TSK_VS_PART_FLAG_ENUM flags;  
+} TSK_DB_VS_PART_INFO;
+
+ostream& operator <<(ostream &os,const TSK_DB_VS_PART_INFO &vsPartInfos);
+
+/** \internal
+ * C++ class that serves as interface to direct database handling classes. 
+ */
+class TskDb {
+  public:
+#ifdef TSK_WIN32
+//@@@@
+    TskDb(const TSK_TCHAR * a_dbFilePath, bool a_blkMapFlag);
+#endif
+    TskDb(const char *a_dbFilePathUtf8, bool a_blkMapFlag);
+    virtual ~TskDb() {};
+    virtual int open(bool) = 0;
+    virtual int close() = 0;
+    virtual int addImageInfo(int type, int size, int64_t & objId, const string & timezone) = 0;
+    virtual int addImageInfo(int type, int size, int64_t & objId, const string & timezone, TSK_OFF_T, const string &md5) = 0;
+    virtual int addImageName(int64_t objId, char const *imgName, int sequence) = 0;
+    virtual int addVsInfo(const TSK_VS_INFO * vs_info, int64_t parObjId, int64_t & objId) = 0;
+    virtual int addVolumeInfo(const TSK_VS_PART_INFO * vs_part, int64_t parObjId, int64_t & objId) = 0;
+    virtual int addFsInfo(const TSK_FS_INFO * fs_info, int64_t parObjId, int64_t & objId) = 0;
+    virtual int addFsFile(TSK_FS_FILE * fs_file, const TSK_FS_ATTR * fs_attr,
+        const char *path, const unsigned char *const md5,
+        const TSK_DB_FILES_KNOWN_ENUM known, int64_t fsObjId,
+        int64_t & objId) = 0;
+
+    virtual TSK_RETVAL_ENUM addVirtualDir(const int64_t fsObjId, const int64_t parentDirId, const char * const name, int64_t & objId) = 0;
+    virtual TSK_RETVAL_ENUM addUnallocFsBlockFilesParent(const int64_t fsObjId, int64_t & objId) = 0;
+    virtual TSK_RETVAL_ENUM addUnallocBlockFile(const int64_t parentObjId, const int64_t fsObjId, const uint64_t size, 
+        vector<TSK_DB_FILE_LAYOUT_RANGE> & ranges, int64_t & objId) = 0;
+    virtual TSK_RETVAL_ENUM addUnusedBlockFile(const int64_t parentObjId, const int64_t fsObjId, const uint64_t size, 
+        vector<TSK_DB_FILE_LAYOUT_RANGE> & ranges, int64_t & objId) = 0;
+    virtual TSK_RETVAL_ENUM addCarvedFile(const int64_t parentObjId, const int64_t fsObjId, const uint64_t size, 
+        vector<TSK_DB_FILE_LAYOUT_RANGE> & ranges, int64_t & objId) = 0;
+    
+    virtual int addFileLayoutRange(const TSK_DB_FILE_LAYOUT_RANGE & fileLayoutRange) = 0;
+    virtual int addFileLayoutRange(int64_t a_fileObjId, uint64_t a_byteStart, uint64_t a_byteLen, int a_sequence) = 0;
+    
+    virtual bool dbExist() const = 0;
+    virtual int createSavepoint(const char *name) = 0;
+    virtual int revertSavepoint(const char *name) = 0;
+    virtual int releaseSavepoint(const char *name) = 0;
+    virtual bool inTransaction() = 0;
+
+    //query methods / getters
+    virtual TSK_RETVAL_ENUM getFileLayouts(vector<TSK_DB_FILE_LAYOUT_RANGE> & fileLayouts) = 0;
+    virtual TSK_RETVAL_ENUM getFsInfos(int64_t imgId, vector<TSK_DB_FS_INFO> & fsInfos) = 0;
+    virtual TSK_RETVAL_ENUM getVsInfos(int64_t imgId, vector<TSK_DB_VS_INFO> & vsInfos) = 0;
+    virtual TSK_RETVAL_ENUM getVsInfo(int64_t objId, TSK_DB_VS_INFO & vsInfo) = 0;
+    virtual TSK_RETVAL_ENUM getVsPartInfos(int64_t imgId, vector<TSK_DB_VS_PART_INFO> & vsPartInfos) = 0;
+    virtual TSK_RETVAL_ENUM getObjectInfo(int64_t objId, TSK_DB_OBJECT & objectInfo) = 0;
+    virtual TSK_RETVAL_ENUM getParentImageId (const int64_t objId, int64_t & imageId) = 0;
+    virtual TSK_RETVAL_ENUM getFsRootDirObjectInfo(const int64_t fsObjId, TSK_DB_OBJECT & rootDirObjInfo) = 0;
+};
+
+#endif

tsk/auto/tsk_db_sqlite.h

@@ -11,151 +11,24 @@
 /**
  * \file tsk_db_sqlite.h
  * Contains the SQLite code for maintaining the case-level database.
- * In the future, an interface will be developed for these so that 
- * different databases can exist. 
+ * The class is an extension of TSK abstract database handling class. 
  */
 
 #ifndef _TSK_DB_SQLITE_H
 #define _TSK_DB_SQLITE_H
 
 #include <map>
-#include <vector>
-
-#include <string>
-#include <ostream>
-
 
 #include "sqlite3.h"
-#include "tsk_auto_i.h"
+#include "tsk_db.h"
 
 using std::map;
-using std::vector;
-using std::string;
-using std::ostream;
-
-typedef struct sqlite3 sqlite3;
-
-
-/**
- * Values for the type column in the tsk_objects table. 
- */
-typedef enum {
-    TSK_DB_OBJECT_TYPE_IMG = 0, ///< Object is a disk image
-    TSK_DB_OBJECT_TYPE_VS,      ///< Object is a volume system. 
-    TSK_DB_OBJECT_TYPE_VOL,     ///< Object is a volume 
-    TSK_DB_OBJECT_TYPE_FS,      ///< Object is a file system
-    TSK_DB_OBJECT_TYPE_FILE,    ///< Object is a file (exact type can be determined in the tsk_files table via TSK_DB_FILES_TYPE_ENUM)
-} TSK_DB_OBJECT_TYPE_ENUM;
-
-/**
- * Values for the files type column in the tsk_files table.
- */
-typedef enum {
-    TSK_DB_FILES_TYPE_FS = 0,   ///< File that can be found in file system tree. 
-    TSK_DB_FILES_TYPE_CARVED,   ///< Set of blocks for a file found from carving.  Could be on top of a TSK_DB_FILES_TYPE_UNALLOC_BLOCKS range. 
-    TSK_DB_FILES_TYPE_DERIVED,  ///< File derived from a parent file (i.e. from ZIP)
-    TSK_DB_FILES_TYPE_LOCAL,    ///< Local file that was added (not from a disk image)
-    TSK_DB_FILES_TYPE_UNALLOC_BLOCKS,   ///< Set of blocks not allocated by file system.  Parent should be image, volume, or file system.  Many columns in tsk_files will be NULL. Set layout in tsk_file_layout. 
-    TSK_DB_FILES_TYPE_UNUSED_BLOCKS, ///< Set of blocks that are unallocated AND not used by a carved or other file type.  Parent should be UNALLOC_BLOCKS, many columns in tsk_files will be NULL, set layout in tsk_file_layout. 
-    TSK_DB_FILES_TYPE_VIRTUAL_DIR, ///< Virtual directory (not on fs) with no meta-data entry that can be used to group files of types other than TSK_DB_FILES_TYPE_FS. Its parent is either another TSK_DB_FILES_TYPE_FS or a root directory or type TSK_DB_FILES_TYPE_FS.
-} TSK_DB_FILES_TYPE_ENUM;
-
-
-
-/**
-* Values for the "known" column of the tsk_files table
-*/
-typedef enum  {
-    TSK_DB_FILES_KNOWN_UNKNOWN = 0,  ///< Not matched against an index
-    TSK_DB_FILES_KNOWN_KNOWN = 1,    ///< Match found in a "known" file index (such as NIST NSRL)and could be good or bad.  
-    TSK_DB_FILES_KNOWN_KNOWN_BAD = 2,      ///< Match found in a "known bad" index
-    TSK_DB_FILES_KNOWN_KNOWN_GOOD = 3,      ///< Match found in a "known good" index
-} TSK_DB_FILES_KNOWN_ENUM;
-
-
-/**
-* Structure wrapping a single tsk objects db entry
-*/
-typedef struct _TSK_DB_OBJECT {
-    int64_t objId; ///< set to 0 if unknown (before it becomes a db object)
-    int64_t parObjId;
-    TSK_DB_OBJECT_TYPE_ENUM type;    
-} TSK_DB_OBJECT;
-
-ostream& operator <<(ostream &os,const TSK_DB_OBJECT &dbObject);
-
-/**
-* Structure wrapping a single file_layout db entry
-*/
-typedef struct _TSK_DB_FILE_LAYOUT_RANGE {
-    //default constructor
-    _TSK_DB_FILE_LAYOUT_RANGE()
-        : fileObjId(0),byteStart(0),byteLen(0),sequence(0) {}
-    //constructor for non-db object (before it becomes one)
-    _TSK_DB_FILE_LAYOUT_RANGE(uint64_t byteStart, uint64_t byteLen, int sequence)
-        : fileObjId(0),byteStart(byteStart),byteLen(byteLen),sequence(sequence) {}
- 
-    int64_t fileObjId; ///< set to 0 if unknown (before it becomes a db object)
-    uint64_t byteStart;
-    uint64_t byteLen;
-    int sequence;
-
-    //default comparator by sequence
-    bool operator< (const struct _TSK_DB_FILE_LAYOUT_RANGE & rhs) const
-    { return sequence < rhs.sequence; }
-
-} TSK_DB_FILE_LAYOUT_RANGE;
-
-ostream& operator <<(ostream &os,const TSK_DB_FILE_LAYOUT_RANGE &layoutRange);
-
-/**
-* Structure wrapping a single fs info db entry
-*/
-typedef struct _TSK_DB_FS_INFO {
-    int64_t objId; ///< set to 0 if unknown (before it becomes a db object)
-    TSK_OFF_T imgOffset;
-    TSK_FS_TYPE_ENUM fType;
-    unsigned int block_size;
-    TSK_DADDR_T block_count;
-    TSK_INUM_T root_inum;
-    TSK_INUM_T first_inum;
-    TSK_INUM_T last_inum;     
-} TSK_DB_FS_INFO;
-
-ostream& operator <<(ostream &os,const TSK_DB_FS_INFO &fsInfo);
-
-
-/**
-* Structure wrapping a single vs info db entry
-*/
-typedef struct _TSK_DB_VS_INFO {
-    int64_t objId; ///< set to 0 if unknown (before it becomes a db object)
-    TSK_VS_TYPE_ENUM vstype;
-    TSK_DADDR_T offset;
-    unsigned int block_size;  
-} TSK_DB_VS_INFO;
-
-ostream& operator <<(ostream &os,const TSK_DB_VS_INFO &vsInfo);
-
-/**
-* Structure wrapping a single vs part db entry
-*/
-#define TSK_MAX_DB_VS_PART_INFO_DESC_LEN 512
-typedef struct _TSK_DB_VS_PART_INFO {
-    int64_t objId; ///< set to 0 if unknown (before it becomes a db object)
-    TSK_PNUM_T addr;
-    TSK_DADDR_T start;
-    TSK_DADDR_T len;
-    char desc[TSK_MAX_DB_VS_PART_INFO_DESC_LEN];
-    TSK_VS_PART_FLAG_ENUM flags;  
-} TSK_DB_VS_PART_INFO;
 
-ostream& operator <<(ostream &os,const TSK_DB_VS_PART_INFO &vsPartInfos);
 
 /** \internal
  * C++ class that wraps the database internals. 
  */
-class TskDbSqlite {
+class TskDbSqlite : public TskDb {
   public:
 #ifdef TSK_WIN32
 //@@@@

win32/libtsk/libtsk.vcxproj

@@ -203,6 +203,7 @@ copy "$(LIBEWF_HOME)\msvscpp\x64\release\zlib.dll" "$(OutDir)"
     </ClCompile>
   </ItemDefinitionGroup>
   <ItemGroup>
+    <ClCompile Include="..\..\tsk\auto\tsk_db.cpp" />
     <ClCompile Include="..\..\tsk\fs\exfatfs_dent.c" />
     <ClCompile Include="..\..\tsk\fs\exfatfs.c" />
     <ClCompile Include="..\..\tsk\fs\exfatfs_meta.c" />
@@ -299,6 +300,7 @@ copy "$(LIBEWF_HOME)\msvscpp\x64\release\zlib.dll" "$(OutDir)"
     <ClCompile Include="..\..\tsk\img\raw.c" />
   </ItemGroup>
   <ItemGroup>
+    <ClInclude Include="..\..\tsk\auto\tsk_db.h" />
     <ClInclude Include="..\..\tsk\fs\tsk_exfatfs.h" />
     <ClInclude Include="..\..\tsk\fs\tsk_fatxxfs.h" />
     <ClInclude Include="..\..\tsk\hashdb\tsk_hash_info.h" />

win32/libtsk/libtsk.vcxproj.filters

@@ -303,6 +303,9 @@
     <ClCompile Include="..\..\tsk\hashdb\binsrch_index.cpp">
       <Filter>hash</Filter>
     </ClCompile>
+    <ClCompile Include="..\..\tsk\auto\tsk_db.cpp">
+      <Filter>auto</Filter>
+    </ClCompile>
   </ItemGroup>
   <ItemGroup>
     <ClInclude Include="..\..\tsk\vs\tsk_bsd.h">
@@ -407,5 +410,8 @@
     <ClInclude Include="..\..\tsk\hashdb\tsk_hash_info.h">
       <Filter>hash</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\tsk\auto\tsk_db.h">
+      <Filter>auto</Filter>
+    </ClInclude>
   </ItemGroup>
 </Project>
\ No newline at end of file