#197 Improve globbing for multiple segments

closed-fixed
nobody
5
2012-05-08
2012-01-19
Rob
No

TSK recently added the ability to specify only the .E01 file in a segmented EWF image. The attached patch allows for more than 676 .E01 segments (where .EZZ rolls over to .FAA) by using libewf's globbing function directly. It also moves the EWF segment globbing to ewf.c so that we don't test for .001 and other segment formats when examining an EWF file (and we don't test for .E01, .E02, etc. when looking at a DD image).

The patch also expands the segment globbing patterns to include .001 (rolling over from .999 to .1000 as FTK does), .01, _001, _01, .000, _000, .00, _00, .aa, .aaa, xaa (from split(1)), and .002.dmgpart (from Apple's hdiutil).

Finally, it changes img_open.c to use split by default when guessing the image type. If the user doesn't want automatic globbing for more segments, they'd need to specify TSK_IMG_TYPE_RAW_SING. I'm not sure if that's the best policy, or if auto-globbing should only be enabled if TSK_IMG_TYPE_RAW_SPLIT. But it's a start.

Discussion

  • Rob
    Rob
    2012-01-19

     
    Attachments
  • Rob
    Rob
    2012-01-19

    (The patch is against master as of Jan 13 2012, e5794db.)

     
  • Brian Carrier
    Brian Carrier
    2012-05-08

    • status: open --> closed-fixed
     
  • Brian Carrier
    Brian Carrier
    2012-05-08

    This patch was integrated as a github pull request.