[sleuthkit-developers] [ sleuthkit-Bugs-2475246 ] istat not showing ExtX sparse blocks

[SourceForge.net <no...@so...>]

Bugs item #2475246, was opened at 2008-12-29 12:46
Message generated for change (Comment added) made by carrier
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2475246&group_id=55685

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: File System Tools
Group: None
>Status: Closed
>Resolution: Fixed
Priority: 5
Private: No
Submitted By: Brian Carrier (carrier)
Assigned to: Brian Carrier (carrier)
Summary: istat not showing ExtX sparse blocks

Initial Comment:
Reported by Simson Garfinkel:

You can download the scan from   http://old.honeynet.org/scans/scan15/

12:52 PM m:~/honeynet$ istat honeypot.hda8.dd  56231
inode: 56231
Not Allocated
Group: 28
Generation Id: 2386177400
uid / gid: 0 / 0
mode: rrw-r--r--
size: 33135
num of links: 0

Inode Times:
Accessed:	Thu Mar 15 03:17:36 2001
File Modified:	Thu Mar 15 03:17:36 2001
Inode Modified:	Thu Mar 15 03:17:36 2001
Deleted:	Thu Mar 15 03:17:36 2001

Direct Blocks:
229685 229686 229687 229688 229689 229690 229691 229692
229693 229694 229695 229696

There should be several zeros after this. 

----------------------------------------------------------------------

>Comment By: Brian Carrier (carrier)
Date: 2008-12-29 13:11

Message:
Fixed in 3.0 and trunk by properly setting _CONT flag in sparse blocks for
Ext and FFS.

Sending        fs/ext2fs.c
Sending        fs/ffs.c
Sending        fs/fs_attr.c
Sending        fs/tsk_fs.h
Transmitting file data ....
Committed revision 34.
Also in 32 and 33.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2475246&group_id=55685