diff --git a/CHANGES.txt b/CHANGES.txt index 6b5d6fdf106133c35c4d0e888425ba3279e74225..dbcbe522f4af30fb69273e7abc2cfcaa529465c9 100644 --- a/CHANGES.txt +++ b/CHANGES.txt @@ -103,9 +103,13 @@ in extended partitions were not marked as Meta. 10/27/09: Update: 'mmls -b' is now 'mmls -B'. Similarly with istat -b. -10/27/09: Update: Added sector_size value to IMG_INFO and file and volume +10/27/09: Update/Fix: Added sector_size value to IMG_INFO and file and volume systems now use it instead of assuming 512. Also added -b options to all -command line tools to allow user to specify the device sector size. +command line tools to allow user to specify the device sector size. This +solves bug 2874854. + +10/28/09: Update: Changed command line format for '-o' so that sector size +is specified only via -b and not using '-o 62@4096'. ---------------- VERSION 3.0.1 -------------- 11/11/08: Bug Fix: Fixed crashing bug in ifind on FAT file system. diff --git a/man/blkcalc.1 b/man/blkcalc.1 index 6281ea4d2746ffb92f55b0a470f8b12b68359890..45fd9010f9e33ed68c61f28e05232bfd3e850a37 100644 --- a/man/blkcalc.1 +++ b/man/blkcalc.1 @@ -51,8 +51,7 @@ If not given, autodetection methods are used. Identify the type of image file, such as raw or split. Use '-i list' to list the supported types. If not given, autodetection methods are used. .IP "-o imgoffset" -The sector offset where the file system starts in the image. Non-512 byte -sectors can be specified using '@' (32@2048) +The sector offset where the file system starts in the image. .IP "-b dev_sector_size" The size, in bytes, of the underlying device sectors. If not given, the value in the image format is used (if it exists) or 512-bytes is assumed. .IP -v diff --git a/man/blkcat.1 b/man/blkcat.1 index 969a6fb47ff05286688ad267d0b0165079acf51f..c820c15e1d3f814a1ec7a353fff582a1f990c5a0 100644 --- a/man/blkcat.1 +++ b/man/blkcat.1 @@ -40,8 +40,7 @@ images. Identify the type of image file, such as raw or split. Use '-i list' to list the supported types. If not given, autodetection methods are used. .IP "-o imgoffset" -The sector offset where the file system starts in the image. Non-512 byte -sectors can be specified using '@' (32@2048). +The sector offset where the file system starts in the image. .IP "-b dev_sector_size" The size, in bytes, of the underlying device sectors. If not given, the value in the image format is used (if it exists) or 512-bytes is assumed. .IP -v diff --git a/man/blkls.1 b/man/blkls.1 index 25487e74bbf5e3bc3fa94cdc48c1fca2168243eb..6554054286ed6d5307218ccbec61854700601e73 100644 --- a/man/blkls.1 +++ b/man/blkls.1 @@ -43,8 +43,7 @@ If not given, autodetection methods are used. Identify the type of image file, such as raw or split. Use '-i list' to list the supported types. If not given, autodetection methods are used. .IP "-o imgoffset" -The sector offset where the file system starts in the image. Non-512 byte -sectors can be specified using '@' (32@2048). +The sector offset where the file system starts in the image. .IP "-b dev_sector_size" The size, in bytes, of the underlying device sectors. If not given, the value in the image format is used (if it exists) or 512-bytes is assumed. .IP -l diff --git a/man/blkstat.1 b/man/blkstat.1 index dcf675730b651e4b0e448a1bbbb67f8c62816aa1..d9407f37d477ae41bc4f687479b8af2d29969018 100644 --- a/man/blkstat.1 +++ b/man/blkstat.1 @@ -22,8 +22,7 @@ If not given, autodetection methods are used. Identify the type of image file, such as raw or split. Use '-i list' to list the supported types. If not given, autodetection methods are used. .IP "-o imgoffset" -The sector offset where the file system starts in the image. Non-512 byte -sectors can be specified using '@' (32@2048). +The sector offset where the file system starts in the image. .IP "-b dev_sector_size" The size, in bytes, of the underlying device sectors. If not given, the value in the image format is used (if it exists) or 512-bytes is assumed. .IP -v diff --git a/man/ffind.1 b/man/ffind.1 index 02950bba0e7fba5073bc1f2e027ff1197d9e461c..09882f8ac332b79c7c50c85f91f076d4b6e1d1c0 100644 --- a/man/ffind.1 +++ b/man/ffind.1 @@ -34,8 +34,7 @@ Find undeleted entries only. Identify the type of image file, such as raw or split. Use '-i list' to list the supported types. If not given, autodetection methods are used. .IP "-o imgoffset" -The sector offset where the file system starts in the image. Non-512 byte -sectors can be specified using '@' (32@2048). +The sector offset where the file system starts in the image. .IP "-b dev_sector_size" The size, in bytes, of the underlying device sectors. If not given, the value in the image format is used (if it exists) or 512-bytes is assumed. .IP -v diff --git a/man/fls.1 b/man/fls.1 index 4b7db7c45a3a4cdd5efc1c867eb6ffd2e30addbd..31d6eb7b836999b341cf25a8f52199131924220f 100644 --- a/man/fls.1 +++ b/man/fls.1 @@ -66,8 +66,7 @@ is only used if -l or -m are given. Identify the type of image file, such as raw or split. Use '-i list' to list the supported types. If not given, autodetection methods are used. .IP "-o imgoffset" -The sector offset where the file system starts in the image. Non-512 byte -sectors can be specified using '@' (32@2048). +The sector offset where the file system starts in the image. .IP "-b dev_sector_size" The size, in bytes, of the underlying device sectors. If not given, the value in the image format is used (if it exists) or 512-bytes is assumed. .IP -u diff --git a/man/fsstat.1 b/man/fsstat.1 index 67518bfd7f379192d2bfcbbadf894001af58d184..40108159ac6882af17406c4bbad5209a41d13186 100644 --- a/man/fsstat.1 +++ b/man/fsstat.1 @@ -29,8 +29,7 @@ If not given, autodetection methods are used. Identify the type of image file, such as raw or split. Use '-i list' to list the supported types. If not given, autodetection methods are used. .IP "-o imgoffset" -The sector offset where the file system starts in the image. Non-512 byte -sectors can be specified using '@' (32@2048). +The sector offset where the file system starts in the image. .IP "-b dev_sector_size" The size, in bytes, of the underlying device sectors. If not given, the value in the image format is used (if it exists) or 512-bytes is assumed. .IP -v diff --git a/man/icat.1 b/man/icat.1 index 8321e7291bbb92905a90071afa503b945837b25a..d14b9252d1bb4f3a3328122fd294928de26b6b90 100644 --- a/man/icat.1 +++ b/man/icat.1 @@ -34,8 +34,7 @@ Include the slack space in the output. Identify the type of image file, such as raw or split. Use '-i list' to list the supported types. If not given, autodetection methods are used. .IP "-o imgoffset" -The sector offset where the file system starts in the image. Non-512 byte -sectors can be specified using '@' (32@2048). +The sector offset where the file system starts in the image. .IP "-b dev_sector_size" The size, in bytes, of the underlying device sectors. If not given, the value in the image format is used (if it exists) or 512-bytes is assumed. .IP -v diff --git a/man/ifind.1 b/man/ifind.1 index 01dc7a323209fb58f98e01745e842842b6393c5b..d80f98edf1c0ecac748be16da6171c892308dc64 100644 --- a/man/ifind.1 +++ b/man/ifind.1 @@ -45,8 +45,7 @@ List the details of each file found with '-p', like 'fls -l'. Identify the type of image file, such as raw or split. Use '-i list' to list the supported types. If not given, autodetection methods are used. .IP "-o imgoffset" -The sector offset where the file system starts in the image. Non-512 byte -sectors can be specified using '@' (32@2048). +The sector offset where the file system starts in the image. .IP "-b dev_sector_size" The size, in bytes, of the underlying device sectors. If not given, the value in the image format is used (if it exists) or 512-bytes is assumed. .IP -v diff --git a/man/ils.1 b/man/ils.1 index f193fbe4f98b564e9ab5cddef4d459694920bc79..a45bc2241692d05b7558292838c063311157da0d 100644 --- a/man/ils.1 +++ b/man/ils.1 @@ -58,8 +58,7 @@ for \fB-LZ\fR Identify the type of image file, such as raw or split. Use '-i list' to list the supported types. If not given, autodetection methods are used. .IP "-o imgoffset" -The sector offset where the file system starts in the image. Non-512 byte -sectors can be specified using '@' (32@2048). +The sector offset where the file system starts in the image. .IP "-b dev_sector_size" The size, in bytes, of the underlying device sectors. If not given, the value in the image format is used (if it exists) or 512-bytes is assumed. .IP \fB-v\fR diff --git a/man/istat.1 b/man/istat.1 index 55654f78e83648823d4aaf433b2668105db16715..8f95c1e9bc774045ca207f85292cacd130ebb56b 100644 --- a/man/istat.1 +++ b/man/istat.1 @@ -32,8 +32,7 @@ original system was 100 seconds slow, this value would be -100. Identify the type of image file, such as raw or split. Use '-i list' to list the supported types. If not given, autodetection methods are used. .IP "-o imgoffset" -The sector offset where the file system starts in the image. Non-512 byte -sectors can be specified using '@' (32@2048). +The sector offset where the file system starts in the image. .IP "-b dev_sector_size" The size, in bytes, of the underlying device sectors. If not given, the value in the image format is used (if it exists) or 512-bytes is assumed. .IP -v diff --git a/man/jcat.1 b/man/jcat.1 index 40eba3a1a3df0b789349d23666e5766206bb70ca..c84381873653139d37e7cb5f0113240d081919ce 100644 --- a/man/jcat.1 +++ b/man/jcat.1 @@ -24,8 +24,7 @@ Specify the file system type. Use '-f list' to list the supported file system t .IP "-i imgtype" Identify the type of image file, such as raw or split. Use '-i list' to list the supported types. If not given, autodetection methods are used. .IP "-o imgoffset" -The sector offset where the file system starts in the image. Non-512 byte -sectors can be specified using '@' (32@2048). +The sector offset where the file system starts in the image. .IP "-b dev_sector_size" The size, in bytes, of the underlying device sectors. If not given, the value in the image format is used (if it exists) or 512-bytes is assumed. .IP -V diff --git a/man/jls.1 b/man/jls.1 index b56c940dfde6962f23629a0cfefb8b313d771c80..00747ed99c7a32b270c00fb663c4253595502114 100644 --- a/man/jls.1 +++ b/man/jls.1 @@ -21,8 +21,7 @@ Use '-f list' to list the supported file system types. If not given, autodetecti .IP "-i imgtype" Identify the type of image file, such as raw or split. Use '-i list' to list the supported types. If not given, autodetection methods are used. .IP "-o imgoffset" -The sector offset where the file system starts in the image. Non-512 byte -sectors can be specified using '@' (32@2048). +The sector offset where the file system starts in the image. .IP "-b dev_sector_size" The size, in bytes, of the underlying device sectors. If not given, the value in the image format is used (if it exists) or 512-bytes is assumed. .IP -V diff --git a/tools/fstools/blkcalc.cpp b/tools/fstools/blkcalc.cpp index e5d6df939d6c7f4f93ce8725f4ae37592c73eea6..ea82cc52920be1aaf70b0a181449ba5e0ec83bc1 100644 --- a/tools/fstools/blkcalc.cpp +++ b/tools/fstools/blkcalc.cpp @@ -63,7 +63,7 @@ main(int argc, char **argv1) TSK_IMG_TYPE_ENUM imgtype = TSK_IMG_TYPE_DETECT; TSK_IMG_INFO *img; - TSK_OFF_T imgoff = 0; + TSK_OFF_T imgaddr = 0; TSK_FS_TYPE_ENUM fstype = TSK_FS_TYPE_DETECT; TSK_FS_INFO *fs; @@ -147,7 +147,7 @@ main(int argc, char **argv1) break; case _TSK_T('o'): - if ((imgoff = tsk_parse_offset(OPTARG)) == -1) { + if ((imgaddr = tsk_parse_offset(OPTARG)) == -1) { tsk_error_print(stderr); exit(1); } @@ -207,14 +207,14 @@ main(int argc, char **argv1) tsk_error_print(stderr); exit(1); } - if (imgoff >= img->size) { + if ((imgaddr * img->sector_size) >= img->size) { tsk_fprintf(stderr, "Sector offset supplied is larger than disk image (maximum: %" PRIu64 ")\n", img->size / 512); exit(1); } - if ((fs = tsk_fs_open_img(img, imgoff, fstype)) == NULL) { + if ((fs = tsk_fs_open_img(img, imgaddr * img->sector_size, fstype)) == NULL) { tsk_error_print(stderr); if (tsk_errno == TSK_ERR_FS_UNSUPTYPE) tsk_fs_type_print(stderr); diff --git a/tools/fstools/blkcat.cpp b/tools/fstools/blkcat.cpp index b765c2de41787eea8beb0110bca80fa0e633b583..f2d20ececa90b4a109eb42e9f546de76079225c8 100644 --- a/tools/fstools/blkcat.cpp +++ b/tools/fstools/blkcat.cpp @@ -64,7 +64,7 @@ main(int argc, char **argv1) TSK_IMG_TYPE_ENUM imgtype = TSK_IMG_TYPE_DETECT; TSK_IMG_INFO *img; - TSK_OFF_T imgoff = 0; + TSK_OFF_T imgaddr = 0; TSK_FS_TYPE_ENUM fstype = TSK_FS_TYPE_DETECT; TSK_FS_INFO *fs; @@ -143,7 +143,7 @@ main(int argc, char **argv1) } break; case _TSK_T('o'): - if ((imgoff = tsk_parse_offset(OPTARG)) == -1) { + if ((imgaddr = tsk_parse_offset(OPTARG)) == -1) { tsk_error_print(stderr); exit(1); } @@ -213,7 +213,7 @@ main(int argc, char **argv1) tsk_error_print(stderr); exit(1); } - if (imgoff >= img->size) { + if ((imgaddr * img->sector_size) >= img->size) { tsk_fprintf(stderr, "Sector offset supplied is larger than disk image (maximum: %" PRIu64 ")\n", img->size / 512); @@ -239,7 +239,7 @@ main(int argc, char **argv1) tsk_error_print(stderr); exit(1); } - if (imgoff >= img->size) { + if ((imgaddr * img->sector_size) >= img->size) { tsk_fprintf(stderr, "Sector offset supplied is larger than disk image (maximum: %" PRIu64 ")\n", img->size / 512); @@ -268,7 +268,7 @@ main(int argc, char **argv1) tsk_error_print(stderr); exit(1); } - if (imgoff >= img->size) { + if ((imgaddr * img->sector_size) >= img->size) { tsk_fprintf(stderr, "Sector offset supplied is larger than disk image (maximum: %" PRIu64 ")\n", img->size / 512); @@ -278,7 +278,7 @@ main(int argc, char **argv1) } /* open the file */ - if ((fs = tsk_fs_open_img(img, imgoff, fstype)) == NULL) { + if ((fs = tsk_fs_open_img(img, imgaddr * img->sector_size, fstype)) == NULL) { tsk_error_print(stderr); if (tsk_errno == TSK_ERR_FS_UNSUPTYPE) tsk_fs_type_print(stderr); diff --git a/tools/fstools/blkls.cpp b/tools/fstools/blkls.cpp index a4f5d0b9033e1d73b1d76a38a8dc1a3e5ff398ef..081abdf6c230403153c3987b67a8de441da51db5 100644 --- a/tools/fstools/blkls.cpp +++ b/tools/fstools/blkls.cpp @@ -71,7 +71,7 @@ main(int argc, char **argv1) TSK_IMG_TYPE_ENUM imgtype = TSK_IMG_TYPE_DETECT; TSK_IMG_INFO *img; - TSK_OFF_T imgoff = 0; + TSK_OFF_T imgaddr = 0; TSK_FS_TYPE_ENUM fstype = TSK_FS_TYPE_DETECT; TSK_FS_INFO *fs; @@ -154,7 +154,7 @@ main(int argc, char **argv1) lclflags = TSK_FS_BLKLS_LIST; break; case _TSK_T('o'): - if ((imgoff = tsk_parse_offset(OPTARG)) == -1) { + if ((imgaddr = tsk_parse_offset(OPTARG)) == -1) { tsk_error_print(stderr); exit(1); } @@ -193,14 +193,14 @@ main(int argc, char **argv1) tsk_error_print(stderr); exit(1); } - if (imgoff >= img->size) { + if ((imgaddr * img->sector_size) >= img->size) { tsk_fprintf(stderr, "Sector offset supplied is larger than disk image (maximum: %" PRIu64 ")\n", img->size / 512); exit(1); } - if ((fs = tsk_fs_open_img(img, imgoff, fstype)) == NULL) { + if ((fs = tsk_fs_open_img(img, imgaddr * img->sector_size, fstype)) == NULL) { tsk_error_print(stderr); if (tsk_errno == TSK_ERR_FS_UNSUPTYPE) tsk_fs_type_print(stderr); @@ -219,7 +219,7 @@ main(int argc, char **argv1) tsk_error_print(stderr); exit(1); } - if (imgoff >= img->size) { + if ((imgaddr * img->sector_size) >= img->size) { tsk_fprintf(stderr, "Sector offset supplied is larger than disk image (maximum: %" PRIu64 ")\n", img->size / 512); @@ -242,7 +242,7 @@ main(int argc, char **argv1) tsk_error_print(stderr); exit(1); } - if (imgoff >= img->size) { + if ((imgaddr * img->sector_size) >= img->size) { tsk_fprintf(stderr, "Sector offset supplied is larger than disk image (maximum: %" PRIu64 ")\n", img->size / 512); @@ -265,7 +265,7 @@ main(int argc, char **argv1) tsk_error_print(stderr); exit(1); } - if (imgoff >= img->size) { + if ((imgaddr * img->sector_size) >= img->size) { tsk_fprintf(stderr, "Sector offset supplied is larger than disk image (maximum: %" PRIu64 ")\n", img->size / 512); @@ -284,7 +284,7 @@ main(int argc, char **argv1) tsk_error_print(stderr); exit(1); } - if (imgoff >= img->size) { + if ((imgaddr * img->sector_size) >= img->size) { tsk_fprintf(stderr, "Sector offset supplied is larger than disk image (maximum: %" PRIu64 ")\n", img->size / 512); @@ -294,7 +294,7 @@ main(int argc, char **argv1) } } - if ((fs = tsk_fs_open_img(img, imgoff, fstype)) == NULL) { + if ((fs = tsk_fs_open_img(img, imgaddr * img->sector_size, fstype)) == NULL) { tsk_error_print(stderr); if (tsk_errno == TSK_ERR_FS_UNSUPTYPE) tsk_fs_type_print(stderr); diff --git a/tools/fstools/blkstat.cpp b/tools/fstools/blkstat.cpp index 4aef47dc7f5dd4747c9b50d8da90d3ed6e02adea..7b8418d804b1b4f55e1711d1b8852f0fff3ccc7f 100644 --- a/tools/fstools/blkstat.cpp +++ b/tools/fstools/blkstat.cpp @@ -48,7 +48,7 @@ main(int argc, char **argv1) TSK_IMG_TYPE_ENUM imgtype = TSK_IMG_TYPE_DETECT; TSK_IMG_INFO *img; - TSK_OFF_T imgoff = 0; + TSK_OFF_T imgaddr = 0; TSK_FS_TYPE_ENUM fstype = TSK_FS_TYPE_DETECT; TSK_FS_INFO *fs; @@ -113,7 +113,7 @@ main(int argc, char **argv1) } break; case _TSK_T('o'): - if ((imgoff = tsk_parse_offset(OPTARG)) == -1) { + if ((imgaddr = tsk_parse_offset(OPTARG)) == -1) { tsk_error_print(stderr); exit(1); } @@ -151,13 +151,13 @@ main(int argc, char **argv1) tsk_error_print(stderr); exit(1); } - if (imgoff >= img->size) { + if ((imgaddr * img->sector_size) >= img->size) { tsk_fprintf(stderr, "Sector offset supplied is larger than disk image (maximum: %" PRIu64 ")\n", img->size / 512); exit(1); } - if ((fs = tsk_fs_open_img(img, imgoff, fstype)) == NULL) { + if ((fs = tsk_fs_open_img(img, imgaddr * img->sector_size, fstype)) == NULL) { tsk_error_print(stderr); if (tsk_errno == TSK_ERR_FS_UNSUPTYPE) tsk_fs_type_print(stderr); diff --git a/tools/fstools/ffind.cpp b/tools/fstools/ffind.cpp index e2fddacb3f2808c4cfaf09ec8b9af9e087bddcf9..8dc67106c7f3fad9a532a93c9778e1d7951343a9 100644 --- a/tools/fstools/ffind.cpp +++ b/tools/fstools/ffind.cpp @@ -54,7 +54,7 @@ main(int argc, char **argv1) TSK_IMG_TYPE_ENUM imgtype = TSK_IMG_TYPE_DETECT; TSK_IMG_INFO *img; - TSK_OFF_T imgoff = 0; + TSK_OFF_T imgaddr = 0; TSK_FS_TYPE_ENUM fstype = TSK_FS_TYPE_DETECT; TSK_FS_INFO *fs; @@ -127,7 +127,7 @@ main(int argc, char **argv1) } break; case _TSK_T('o'): - if ((imgoff = tsk_parse_offset(OPTARG)) == -1) { + if ((imgaddr = tsk_parse_offset(OPTARG)) == -1) { tsk_error_print(stderr); exit(1); } @@ -178,13 +178,13 @@ main(int argc, char **argv1) tsk_error_print(stderr); exit(1); } - if (imgoff >= img->size) { + if ((imgaddr * img->sector_size) >= img->size) { tsk_fprintf(stderr, "Sector offset supplied is larger than disk image (maximum: %" PRIu64 ")\n", img->size / 512); exit(1); } - if ((fs = tsk_fs_open_img(img, imgoff, fstype)) == NULL) { + if ((fs = tsk_fs_open_img(img, imgaddr * img->sector_size, fstype)) == NULL) { tsk_error_print(stderr); if (tsk_errno == TSK_ERR_FS_UNSUPTYPE) tsk_fs_type_print(stderr); diff --git a/tools/fstools/fls.cpp b/tools/fstools/fls.cpp index f5251ae30dd54ac4147629b8b356f6e1a6387a48..e47f4f8dccb040700e6d531b09f6d9290c87adb6 100644 --- a/tools/fstools/fls.cpp +++ b/tools/fstools/fls.cpp @@ -70,7 +70,7 @@ main(int argc, char **argv1) TSK_IMG_TYPE_ENUM imgtype = TSK_IMG_TYPE_DETECT; TSK_IMG_INFO *img; - TSK_OFF_T imgoff = 0; + TSK_OFF_T imgaddr = 0; TSK_FS_TYPE_ENUM fstype = TSK_FS_TYPE_DETECT; TSK_FS_INFO *fs; @@ -165,7 +165,7 @@ main(int argc, char **argv1) macpre = OPTARG; break; case _TSK_T('o'): - if ((imgoff = tsk_parse_offset(OPTARG)) == -1) { + if ((imgaddr = tsk_parse_offset(OPTARG)) == -1) { tsk_error_print(stderr); exit(1); } @@ -254,13 +254,13 @@ main(int argc, char **argv1) tsk_error_print(stderr); exit(1); } - if (imgoff >= img->size) { + if ((imgaddr * img->sector_size) >= img->size) { tsk_fprintf(stderr, "Sector offset supplied is larger than disk image (maximum: %" PRIu64 ")\n", img->size / 512); exit(1); } - if ((fs = tsk_fs_open_img(img, imgoff, fstype)) == NULL) { + if ((fs = tsk_fs_open_img(img, imgaddr * img->sector_size, fstype)) == NULL) { tsk_error_print(stderr); if (tsk_errno == TSK_ERR_FS_UNSUPTYPE) tsk_fs_type_print(stderr); @@ -283,7 +283,7 @@ main(int argc, char **argv1) tsk_error_print(stderr); exit(1); } - if (imgoff >= img->size) { + if ((imgaddr * img->sector_size) >= img->size) { tsk_fprintf(stderr, "Sector offset supplied is larger than disk image (maximum: %" PRIu64 ")\n", img->size / 512); @@ -291,7 +291,7 @@ main(int argc, char **argv1) } - if ((fs = tsk_fs_open_img(img, imgoff, fstype)) == NULL) { + if ((fs = tsk_fs_open_img(img, imgaddr * img->sector_size, fstype)) == NULL) { tsk_error_print(stderr); if (tsk_errno == TSK_ERR_FS_UNSUPTYPE) tsk_fs_type_print(stderr); diff --git a/tools/fstools/fscheck.cpp b/tools/fstools/fscheck.cpp index 863074ce0026e2672ff13cb02c873477d0b2a078..b528fc99724029ce6f4da62e9ac5e3c1a260453d 100644 --- a/tools/fstools/fscheck.cpp +++ b/tools/fstools/fscheck.cpp @@ -36,7 +36,7 @@ main(int argc, char **argv) TSK_IMG_TYPE_ENUM imgtype = TSK_IMG_TYPE_DETECT; TSK_IMG_INFO *img; - TSK_OFF_T imgoff = 0; + TSK_OFF_T imgaddr = 0; TSK_FS_TYPE_ENUM fstype = TSK_FS_TYPE_DETECT; TSK_FS_INFO *fs; @@ -102,7 +102,7 @@ main(int argc, char **argv) break; case 'o': - if ((imgoff = tsk_parse_offset(OPTARG)) == -1) { + if ((imgaddr = tsk_parse_offset(OPTARG)) == -1) { tsk_error_print(stderr); exit(1); } diff --git a/tools/fstools/fsstat.cpp b/tools/fstools/fsstat.cpp index eaa2d46e0b352e462d019cc0b8372d036756208a..f68594c1ab63f5db6c89ef7c335b77990b1f6944 100644 --- a/tools/fstools/fsstat.cpp +++ b/tools/fstools/fsstat.cpp @@ -46,7 +46,7 @@ main(int argc, char **argv1) TSK_IMG_TYPE_ENUM imgtype = TSK_IMG_TYPE_DETECT; TSK_IMG_INFO *img; - TSK_OFF_T imgoff = 0; + TSK_OFF_T imgaddr = 0; TSK_FS_TYPE_ENUM fstype = TSK_FS_TYPE_DETECT; TSK_FS_INFO *fs; @@ -114,7 +114,7 @@ main(int argc, char **argv1) break; case _TSK_T('o'): - if ((imgoff = tsk_parse_offset(OPTARG)) == -1) { + if ((imgaddr = tsk_parse_offset(OPTARG)) == -1) { tsk_error_print(stderr); exit(1); } @@ -146,14 +146,14 @@ main(int argc, char **argv1) tsk_error_print(stderr); exit(1); } - if (imgoff >= img->size) { + if ((imgaddr * img->sector_size) >= img->size) { tsk_fprintf(stderr, "Sector offset supplied is larger than disk image (maximum: %" PRIu64 ")\n", img->size / 512); exit(1); } - if ((fs = tsk_fs_open_img(img, imgoff, fstype)) == NULL) { + if ((fs = tsk_fs_open_img(img, imgaddr * img->sector_size, fstype)) == NULL) { tsk_error_print(stderr); if (tsk_errno == TSK_ERR_FS_UNSUPTYPE) tsk_fs_type_print(stderr); diff --git a/tools/fstools/icat.cpp b/tools/fstools/icat.cpp index c82d1199fc5be7d853e21d0a1ea0deed9e1b8976..d15f956faa043a3ee6771cfaaf0a37e159b30e0b 100644 --- a/tools/fstools/icat.cpp +++ b/tools/fstools/icat.cpp @@ -60,7 +60,7 @@ main(int argc, char **argv1) TSK_IMG_TYPE_ENUM imgtype = TSK_IMG_TYPE_DETECT; TSK_IMG_INFO *img; - TSK_OFF_T imgoff = 0; + TSK_OFF_T imgaddr = 0; TSK_FS_TYPE_ENUM fstype = TSK_FS_TYPE_DETECT; TSK_FS_INFO *fs; @@ -135,7 +135,7 @@ main(int argc, char **argv1) } break; case _TSK_T('o'): - if ((imgoff = tsk_parse_offset(OPTARG)) == -1) { + if ((imgaddr = tsk_parse_offset(OPTARG)) == -1) { tsk_error_print(stderr); exit(1); } @@ -178,13 +178,13 @@ main(int argc, char **argv1) tsk_error_print(stderr); exit(1); } - if (imgoff >= img->size) { + if ((imgaddr * img->sector_size) >= img->size) { tsk_fprintf(stderr, "Sector offset supplied is larger than disk image (maximum: %" PRIu64 ")\n", img->size / 512); exit(1); } - if ((fs = tsk_fs_open_img(img, imgoff, fstype)) == NULL) { + if ((fs = tsk_fs_open_img(img, imgaddr * img->sector_size, fstype)) == NULL) { tsk_error_print(stderr); if (tsk_errno == TSK_ERR_FS_UNSUPTYPE) tsk_fs_type_print(stderr); diff --git a/tools/fstools/ifind.cpp b/tools/fstools/ifind.cpp index 327550a4cb39000bbe17fa3ef78a2d450cf24bde..2d8c4ac0838f398d62e8f86f4725a296f8360fb7 100644 --- a/tools/fstools/ifind.cpp +++ b/tools/fstools/ifind.cpp @@ -67,7 +67,7 @@ main(int argc, char **argv1) TSK_IMG_TYPE_ENUM imgtype = TSK_IMG_TYPE_DETECT; TSK_IMG_INFO *img; - TSK_OFF_T imgoff = 0; + TSK_OFF_T imgaddr = 0; TSK_FS_TYPE_ENUM fstype = TSK_FS_TYPE_DETECT; TSK_FS_INFO *fs; uint8_t type = 0; @@ -171,7 +171,7 @@ main(int argc, char **argv1) break; } case 'o': - if ((imgoff = tsk_parse_offset(OPTARG)) == -1) { + if ((imgaddr = tsk_parse_offset(OPTARG)) == -1) { tsk_error_print(stderr); exit(1); } @@ -238,14 +238,14 @@ main(int argc, char **argv1) free(path); exit(1); } - if (imgoff >= img->size) { + if ((imgaddr * img->sector_size) >= img->size) { tsk_fprintf(stderr, "Sector offset supplied is larger than disk image (maximum: %" PRIu64 ")\n", img->size / 512); exit(1); } - if ((fs = tsk_fs_open_img(img, imgoff, fstype)) == NULL) { + if ((fs = tsk_fs_open_img(img, imgaddr * img->sector_size, fstype)) == NULL) { tsk_error_print(stderr); if (tsk_errno == TSK_ERR_FS_UNSUPTYPE) tsk_fs_type_print(stderr); diff --git a/tools/fstools/ils.cpp b/tools/fstools/ils.cpp index 6fbefb0db478b596cb7a762885745fd5d158bf7f..2e92a79feb612168ba1ce028c138dce61f99f614 100644 --- a/tools/fstools/ils.cpp +++ b/tools/fstools/ils.cpp @@ -72,7 +72,7 @@ main(int argc, char **argv1) TSK_IMG_TYPE_ENUM imgtype = TSK_IMG_TYPE_DETECT; TSK_IMG_INFO *img; - TSK_OFF_T imgoff = 0; + TSK_OFF_T imgaddr = 0; TSK_FS_TYPE_ENUM fstype = TSK_FS_TYPE_DETECT; TSK_FS_INFO *fs; @@ -155,7 +155,7 @@ main(int argc, char **argv1) ils_flags |= TSK_FS_ILS_MAC; break; case _TSK_T('o'): - if ((imgoff = tsk_parse_offset(OPTARG)) == -1) { + if ((imgaddr = tsk_parse_offset(OPTARG)) == -1) { tsk_error_print(stderr); exit(1); } @@ -231,7 +231,7 @@ main(int argc, char **argv1) tsk_error_print(stderr); exit(1); } - if (imgoff >= img->size) { + if ((imgaddr * img->sector_size) >= img->size) { tsk_fprintf(stderr, "Sector offset supplied is larger than disk image (maximum: %" PRIu64 ")\n", img->size / 512); @@ -249,7 +249,7 @@ main(int argc, char **argv1) tsk_error_print(stderr); exit(1); } - if (imgoff >= img->size) { + if ((imgaddr * img->sector_size) >= img->size) { tsk_fprintf(stderr, "Sector offset supplied is larger than disk image (maximum: %" PRIu64 ")\n", img->size / 512); @@ -272,7 +272,7 @@ main(int argc, char **argv1) tsk_error_print(stderr); exit(1); } - if (imgoff >= img->size) { + if ((imgaddr * img->sector_size) >= img->size) { tsk_fprintf(stderr, "Sector offset supplied is larger than disk image (maximum: %" PRIu64 ")\n", img->size / 512); @@ -293,7 +293,7 @@ main(int argc, char **argv1) tsk_error_print(stderr); exit(1); } - if (imgoff >= img->size) { + if ((imgaddr * img->sector_size) >= img->size) { tsk_fprintf(stderr, "Sector offset supplied is larger than disk image (maximum: %" PRIu64 ")\n", img->size / 512); @@ -310,7 +310,7 @@ main(int argc, char **argv1) tsk_error_print(stderr); exit(1); } - if (imgoff >= img->size) { + if ((imgaddr * img->sector_size) >= img->size) { tsk_fprintf(stderr, "Sector offset supplied is larger than disk image (maximum: %" PRIu64 ")\n", img->size / 512); @@ -320,7 +320,7 @@ main(int argc, char **argv1) } } - if ((fs = tsk_fs_open_img(img, imgoff, fstype)) == NULL) { + if ((fs = tsk_fs_open_img(img, imgaddr * img->sector_size, fstype)) == NULL) { tsk_error_print(stderr); if (tsk_errno == TSK_ERR_FS_UNSUPTYPE) tsk_fs_type_print(stderr); diff --git a/tools/fstools/istat.cpp b/tools/fstools/istat.cpp index afef35438baaedf5e8649e1c74e9c6f9cef65f36..a0d8902f9ef3294cd166ffa14963f504329f6c35 100644 --- a/tools/fstools/istat.cpp +++ b/tools/fstools/istat.cpp @@ -58,7 +58,7 @@ main(int argc, char **argv1) TSK_IMG_TYPE_ENUM imgtype = TSK_IMG_TYPE_DETECT; TSK_IMG_INFO *img; - TSK_OFF_T imgoff = 0; + TSK_OFF_T imgaddr = 0; TSK_FS_TYPE_ENUM fstype = TSK_FS_TYPE_DETECT; TSK_FS_INFO *fs; @@ -138,7 +138,7 @@ main(int argc, char **argv1) } break; case _TSK_T('o'): - if ((imgoff = tsk_parse_offset(OPTARG)) == -1) { + if ((imgaddr = tsk_parse_offset(OPTARG)) == -1) { tsk_error_print(stderr); exit(1); } @@ -192,14 +192,14 @@ main(int argc, char **argv1) tsk_error_print(stderr); exit(1); } - if (imgoff >= img->size) { + if ((imgaddr * img->sector_size) >= img->size) { tsk_fprintf(stderr, "Sector offset supplied is larger than disk image (maximum: %" PRIu64 ")\n", img->size / 512); exit(1); } - if ((fs = tsk_fs_open_img(img, imgoff, fstype)) == NULL) { + if ((fs = tsk_fs_open_img(img, imgaddr * img->sector_size, fstype)) == NULL) { tsk_error_print(stderr); if (tsk_errno == TSK_ERR_FS_UNSUPTYPE) tsk_fs_type_print(stderr); diff --git a/tools/fstools/jcat.cpp b/tools/fstools/jcat.cpp index 017c6af90f8f054c2fb251e11b2de9bfd045ccd8..486a3b12348a10298a5ec0ee4d8c3e02b8769334 100644 --- a/tools/fstools/jcat.cpp +++ b/tools/fstools/jcat.cpp @@ -49,7 +49,7 @@ main(int argc, char **argv1) TSK_IMG_TYPE_ENUM imgtype = TSK_IMG_TYPE_DETECT; TSK_IMG_INFO *img; - TSK_OFF_T imgoff = 0; + TSK_OFF_T imgaddr = 0; TSK_FS_TYPE_ENUM fstype = TSK_FS_TYPE_DETECT; TSK_FS_INFO *fs; @@ -116,7 +116,7 @@ main(int argc, char **argv1) } break; case _TSK_T('o'): - if ((imgoff = tsk_parse_offset(OPTARG)) == -1) { + if ((imgaddr = tsk_parse_offset(OPTARG)) == -1) { tsk_error_print(stderr); exit(1); } @@ -151,14 +151,14 @@ main(int argc, char **argv1) tsk_error_print(stderr); exit(1); } - if (imgoff >= img->size) { + if ((imgaddr * img->sector_size) >= img->size) { tsk_fprintf(stderr, "Sector offset supplied is larger than disk image (maximum: %" PRIu64 ")\n", img->size / 512); exit(1); } - if ((fs = tsk_fs_open_img(img, imgoff, fstype)) == NULL) { + if ((fs = tsk_fs_open_img(img, imgaddr * img->sector_size, fstype)) == NULL) { tsk_error_print(stderr); if (tsk_errno == TSK_ERR_FS_UNSUPTYPE) tsk_fs_type_print(stderr); @@ -175,7 +175,7 @@ main(int argc, char **argv1) exit(1); } - if ((fs = tsk_fs_open_img(img, imgoff, fstype)) == NULL) { + if ((fs = tsk_fs_open_img(img, imgaddr * img->sector_size, fstype)) == NULL) { tsk_error_print(stderr); if (tsk_errno == TSK_ERR_FS_UNSUPTYPE) tsk_fs_type_print(stderr); diff --git a/tools/fstools/jls.cpp b/tools/fstools/jls.cpp index efd2bc8ecce38d9c6dc588ca5cef5156263c25ea..7b53b67bd387a8040aca7c9a2471d21e755a171e 100644 --- a/tools/fstools/jls.cpp +++ b/tools/fstools/jls.cpp @@ -42,7 +42,7 @@ main(int argc, char **argv1) TSK_IMG_TYPE_ENUM imgtype = TSK_IMG_TYPE_DETECT; TSK_IMG_INFO *img; - TSK_OFF_T imgoff = 0; + TSK_OFF_T imgaddr = 0; TSK_FS_TYPE_ENUM fstype = TSK_FS_TYPE_DETECT; TSK_FS_INFO *fs; @@ -108,7 +108,7 @@ main(int argc, char **argv1) } break; case _TSK_T('o'): - if ((imgoff = tsk_parse_offset(OPTARG)) == -1) { + if ((imgaddr = tsk_parse_offset(OPTARG)) == -1) { tsk_error_print(stderr); exit(1); } @@ -141,14 +141,14 @@ main(int argc, char **argv1) tsk_error_print(stderr); exit(1); } - if (imgoff >= img->size) { + if ((imgaddr * img->sector_size) >= img->size) { tsk_fprintf(stderr, "Sector offset supplied is larger than disk image (maximum: %" PRIu64 ")\n", img->size / 512); exit(1); } - if ((fs = tsk_fs_open_img(img, imgoff, fstype)) == NULL) { + if ((fs = tsk_fs_open_img(img, imgaddr * img->sector_size, fstype)) == NULL) { tsk_error_print(stderr); if (tsk_errno == TSK_ERR_FS_UNSUPTYPE) tsk_fs_type_print(stderr); @@ -166,7 +166,7 @@ main(int argc, char **argv1) exit(1); } - if ((fs = tsk_fs_open_img(img, imgoff, fstype)) == NULL) { + if ((fs = tsk_fs_open_img(img, imgaddr * img->sector_size, fstype)) == NULL) { tsk_error_print(stderr); if (tsk_errno == TSK_ERR_FS_UNSUPTYPE) tsk_fs_type_print(stderr); diff --git a/tools/vstools/mmcat.cpp b/tools/vstools/mmcat.cpp index 7d9a300f454c069dd004e83a67f42b17f00db073..8517093bb0a19e1778bc1b56d42af2c94c9a5e39 100644 --- a/tools/vstools/mmcat.cpp +++ b/tools/vstools/mmcat.cpp @@ -41,7 +41,7 @@ main(int argc, char **argv1) TSK_IMG_TYPE_ENUM imgtype = TSK_IMG_TYPE_DETECT; TSK_VS_TYPE_ENUM vstype = TSK_VS_TYPE_DETECT; int ch; - TSK_OFF_T imgoff = 0; + TSK_OFF_T imgaddr = 0; TSK_IMG_INFO *img; TSK_PNUM_T pnum; TSK_DADDR_T addr; @@ -91,7 +91,7 @@ main(int argc, char **argv1) break; case _TSK_T('o'): - if ((imgoff = tsk_parse_offset(OPTARG)) == -1) { + if ((imgaddr = tsk_parse_offset(OPTARG)) == -1) { tsk_error_print(stderr); exit(1); } @@ -136,7 +136,7 @@ main(int argc, char **argv1) tsk_error_print(stderr); exit(1); } - if (imgoff >= img->size) { + if ((imgaddr * img->sector_size) >= img->size) { tsk_fprintf(stderr, "Sector offset supplied is larger than disk image (maximum: %" PRIu64 ")\n", img->size / 512); @@ -149,7 +149,7 @@ main(int argc, char **argv1) } /* process the partition tables */ - if ((vs = tsk_vs_open(img, imgoff, vstype)) == NULL) { + if ((vs = tsk_vs_open(img, imgaddr * img->sector_size, vstype)) == NULL) { tsk_error_print(stderr); if (tsk_errno == TSK_ERR_VS_UNSUPTYPE) tsk_vs_type_print(stderr); diff --git a/tools/vstools/mmls.cpp b/tools/vstools/mmls.cpp index fb7621c7e93dd4fbac8e038ed8ec699185a31978..d9a9745229e7aaa8e8ad47354b0c6c44eeda366e 100644 --- a/tools/vstools/mmls.cpp +++ b/tools/vstools/mmls.cpp @@ -148,7 +148,7 @@ main(int argc, char **argv1) { TSK_VS_INFO *vs; int ch; - TSK_OFF_T imgoff = 0; + TSK_OFF_T imgaddr = 0; int flags = 0; TSK_IMG_INFO *img; TSK_IMG_TYPE_ENUM imgtype = TSK_IMG_TYPE_DETECT; @@ -213,7 +213,7 @@ main(int argc, char **argv1) hide_meta = 1; break; case _TSK_T('o'): - if ((imgoff = tsk_parse_offset(OPTARG)) == -1) { + if ((imgaddr = tsk_parse_offset(OPTARG)) == -1) { tsk_error_print(stderr); exit(1); } @@ -271,7 +271,7 @@ main(int argc, char **argv1) tsk_error_print(stderr); exit(1); } - if (imgoff >= img->size) { + if ((imgaddr * img->sector_size) >= img->size) { tsk_fprintf(stderr, "Sector offset supplied is larger than disk image (maximum: %" PRIu64 ")\n", img->size / 512); @@ -279,7 +279,7 @@ main(int argc, char **argv1) } /* process the partition tables */ - vs = tsk_vs_open(img, (TSK_OFF_T) imgoff, vstype); + vs = tsk_vs_open(img, imgaddr * img->sector_size, vstype); if (vs == NULL) { tsk_error_print(stderr); if (tsk_errno == TSK_ERR_VS_UNSUPTYPE) diff --git a/tools/vstools/mmstat.cpp b/tools/vstools/mmstat.cpp index 50ef70a46aafa9e520279e391d1e1a8e78383447..c26e5e06d7f45dd68400f3a981ab7841bc0c5f8d 100644 --- a/tools/vstools/mmstat.cpp +++ b/tools/vstools/mmstat.cpp @@ -48,7 +48,7 @@ main(int argc, char **argv1) TSK_IMG_TYPE_ENUM imgtype = TSK_IMG_TYPE_DETECT; TSK_VS_TYPE_ENUM vstype = TSK_VS_TYPE_DETECT; int ch; - TSK_OFF_T imgoff = 0; + TSK_OFF_T imgaddr = 0; TSK_IMG_INFO *img; TSK_TCHAR **argv; unsigned int ssize = 0; @@ -93,7 +93,7 @@ main(int argc, char **argv1) break; case _TSK_T('o'): - if ((imgoff = tsk_parse_offset(OPTARG)) == -1) { + if ((imgaddr = tsk_parse_offset(OPTARG)) == -1) { tsk_error_print(stderr); exit(1); } @@ -137,7 +137,7 @@ main(int argc, char **argv1) tsk_error_print(stderr); exit(1); } - if (imgoff >= img->size) { + if ((imgaddr * img->sector_size) >= img->size) { tsk_fprintf(stderr, "Sector offset supplied is larger than disk image (maximum: %" PRIu64 ")\n", img->size / 512); @@ -146,7 +146,7 @@ main(int argc, char **argv1) /* process the partition tables */ - if ((vs = tsk_vs_open(img, imgoff, vstype)) == NULL) { + if ((vs = tsk_vs_open(img, imgaddr * img->sector_size, vstype)) == NULL) { tsk_error_print(stderr); if (tsk_errno == TSK_ERR_VS_UNSUPTYPE) tsk_vs_type_print(stderr); diff --git a/tsk3/base/tsk_parse.c b/tsk3/base/tsk_parse.c index 545090a49e0a37b282deb7b7093b8014644b8acb..c77352dfd72e6446a813eea073243e3b7102a33f 100644 --- a/tsk3/base/tsk_parse.c +++ b/tsk3/base/tsk_parse.c @@ -17,22 +17,20 @@ /** * \ingroup baselib - * Parse a TSK_TCHAR block address string in the cnt\@size or - * cnt format. If size is not given, 512 is used. - * Return the byte offset in an integer format. + * Parse a TSK_TCHAR block address string. + * Note that the cnt\@size format is no longer supported. + * Set the device sector size in img_open to set the block size. * * @param [in] a_offset_str The string version of the offset - * @return -1 on error or byte offset on success + * @return -1 on error or block offset on success */ TSK_OFF_T tsk_parse_offset(const TSK_TCHAR * a_offset_str) { TSK_TCHAR offset_lcl[64], *offset_lcl_p; TSK_DADDR_T num_blk; - TSK_TCHAR *cp, *at; - int bsize; - TSK_OFF_T offset_b; - + TSK_TCHAR *cp; + if (a_offset_str == NULL) { return 0; } @@ -49,41 +47,23 @@ tsk_parse_offset(const TSK_TCHAR * a_offset_str) TSTRNCPY(offset_lcl, a_offset_str, 64); offset_lcl_p = offset_lcl; - /* Check for the x@y setup and set - * bsize if it exists - */ - if ((at = TSTRCHR(offset_lcl_p, '@')) != NULL) { - *at = '\0'; - at++; - - bsize = TSTRTOUL(at, &cp, 0); - if (*cp || *cp == *at) { - tsk_error_reset(); - tsk_errno = TSK_ERR_IMG_OFFSET; - snprintf(tsk_errstr, TSK_ERRSTR_L, - "tsk_parse: block size: %" PRIttocTSK, at); - return -1; - } - else if (bsize % 512) { - tsk_error_reset(); - tsk_errno = TSK_ERR_IMG_OFFSET; - snprintf(tsk_errstr, TSK_ERRSTR_L, - "tsk_parse: block size not multiple of 512"); - return -1; - } - } - else { - bsize = 512; + /* Check for the old x@y setup */ + if (TSTRCHR(offset_lcl_p, '@') != NULL) { + tsk_error_reset(); + tsk_errno = TSK_ERR_IMG_OFFSET; + snprintf(tsk_errstr, TSK_ERRSTR_L, + "tsk_parse: offset string format no longer supported. Use -b to specify sector size: %" PRIttocTSK, + a_offset_str); + return -1; } - - /* Now we address the sector offset */ offset_lcl_p = offset_lcl; /* remove leading 0s */ while ((offset_lcl_p[0] != '\0') && (offset_lcl_p[0] == '0')) offset_lcl_p++; + num_blk = 0; if (offset_lcl_p[0] != '\0') { num_blk = TSTRTOULL(offset_lcl_p, &cp, 0); if (*cp || *cp == *offset_lcl_p) { @@ -94,21 +74,14 @@ tsk_parse_offset(const TSK_TCHAR * a_offset_str) offset_lcl_p); return -1; } - offset_b = num_blk * bsize; - } - else { - offset_b = 0; } - if (tsk_verbose) - tsk_fprintf(stderr, - "tsk_parse_offset: Offset set to %" PRIuOFF "\n", offset_b); - - return offset_b; + return num_blk; } + /** * \ingroup baselib * Parse a TSK_TCHAR string of a partition byte offset and the diff --git a/tsk3/img/img_open.c b/tsk3/img/img_open.c index f3aca554116975ae06fa39e49963394b3f5adada..7c223a0f9630cb32ea07f9da19e3e719bf45c14b 100644 --- a/tsk3/img/img_open.c +++ b/tsk3/img/img_open.c @@ -93,6 +93,14 @@ tsk_img_open(int num_img, snprintf(tsk_errstr, TSK_ERRSTR_L, "sector size is less than 512 bytes (%d)", a_ssize); return NULL; } + + if ((a_ssize % 512) != 0) { + tsk_error_reset(); + tsk_errno = TSK_ERR_IMG_ARG; + snprintf(tsk_errstr, TSK_ERRSTR_L, "sector size is not a multiple of 512 (%d)", a_ssize); + return NULL; + } + if (tsk_verbose) TFPRINTF(stderr,