Menu

#197 Improve globbing for multiple segments

closed-fixed
nobody
5
2012-05-08
2012-01-19
Rob
No

TSK recently added the ability to specify only the .E01 file in a segmented EWF image. The attached patch allows for more than 676 .E01 segments (where .EZZ rolls over to .FAA) by using libewf's globbing function directly. It also moves the EWF segment globbing to ewf.c so that we don't test for .001 and other segment formats when examining an EWF file (and we don't test for .E01, .E02, etc. when looking at a DD image).

The patch also expands the segment globbing patterns to include .001 (rolling over from .999 to .1000 as FTK does), .01, _001, _01, .000, _000, .00, _00, .aa, .aaa, xaa (from split(1)), and .002.dmgpart (from Apple's hdiutil).

Finally, it changes img_open.c to use split by default when guessing the image type. If the user doesn't want automatic globbing for more segments, they'd need to specify TSK_IMG_TYPE_RAW_SING. I'm not sure if that's the best policy, or if auto-globbing should only be enabled if TSK_IMG_TYPE_RAW_SPLIT. But it's a start.

Discussion

  • Rob

    Rob - 2012-01-19
     
  • Rob

    Rob - 2012-01-19

    (The patch is against master as of Jan 13 2012, e5794db.)

     
  • Brian Carrier

    Brian Carrier - 2012-05-08
    • status: open --> closed-fixed
     
  • Brian Carrier

    Brian Carrier - 2012-05-08

    This patch was integrated as a github pull request.

     

Log in to post a comment.

Want the latest updates on software, tech news, and AI?
Get latest updates about software, tech news, and AI from SourceForge directly in your inbox once a month.