[sleuthkit-developers] [ sleuthkit-Bugs-2856526 ] istat -b argument does nothing on HFS+ & NTFS

[SourceForge.net <no...@so...>]

Bugs item #2856526, was opened at 2009-09-10 19:29
Message generated for change (Tracker Item Submitted) made by robjoyce
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2856526&group_id=55685

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: File System Tools
Group: None
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Rob (robjoyce)
Assigned to: Nobody/Anonymous (nobody)
Summary: istat -b argument does nothing on HFS+ & NTFS

Initial Comment:
The -b argument to istat (limiting the number of blocks displayed) doesn't work on HFS+ and NTFS.  For HFS+, I tried adding the hack of setting fs_file->meta->size in hfs_istat() befure the tsk_fs_file_walk() call -- as is done in fatfs.c and ffs.c -- but it didn't have any effect in the current trunk version.   Probably because of the new attr code.

But perhaps a better way to fix this, for all file systems, is to just enforce numblocks in the local print_addr_act() functions... this avoids the hack of temporarily changing the file size.  The print_addr_act() void* argument can contain a field tracking the number of blocks printed.  The downside is that we can't force _more_ blocks to be printed than the file has.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2856526&group_id=55685