[sleuthkit-developers] Block Alignment in FFS / ExtX

[Brian C. <ca...@sl...>]

There is a legacy TCT feature in TSK that I am thinking about  
removing, but first want to see if anyone is using it. In UFS (and in  
theory, but not practice, Ext2/3), a block (4KB for example) is  
broken up into fragments (each 1KB for example). Each fragment has an  
address and an allocation status.

With 'dls' (and ffs_block_walk() for the developers out there), there  
is an alignment option that forces the output to be in block-sized  
chunks.  The fragments that do not meet your filtering criteria (such  
as allocated or unallocated) will be returned with all 0s if there is  
a fragment in the block that does meet your criteria.  Therefore, if  
you use 'dls' to output the unallocated fragments, and there is a  
block that contains some allocated fragments and some unallocated  
fragments, then 'dls' will currently output the allocated fragments  
as all 0s.   I think this is confusing.

I propose to change the behavior so that only fragments that meet the  
filtering criteria are returned. If you ask 'dls' to give you  
unallocated fragments then it gives only unallocated fragments. You  
can currently do this with 'dls' using '-b'.  (in fact, you can see  
the difference by comparing the output of 'dls -l'  and 'dls -lb'.   
'dls -l' will likely have some entries for allocated fragments).

Is anyone depending on this behavior?  Removing it will simplify the  
code.

brian