[sleuthkit-developers] [ sleuthkit-Bugs-2874852 ] Partition Table Sanity Checking

[SourceForge.net <no...@so...>]

Bugs item #2874852, was opened at 2009-10-08 12:07
Message generated for change (Settings changed) made by carrier
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2874852&group_id=55685

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: Media Management Tools
Group: None
>Status: Closed
>Resolution: Fixed
Priority: 5
Private: No
Submitted By: Brian Carrier (carrier)
Assigned to: Nobody/Anonymous (nobody)
Summary: Partition Table Sanity Checking

Initial Comment:
Currently, TSK  stops processing a partition table when it finds a partition that starts outside of the image. Perhaps this should be relaxed so that it reports the results and then the user needs to figure out that it does not fit.... Reported by Simson Garfinkel.

Note for Brian: This can be seen in the AV iso image from Simson.




----------------------------------------------------------------------

>Comment By: Brian Carrier (carrier)
Date: 2009-11-03 20:13

Message:
Fixed in trunk. 
Sending        vs/bsd.c
Sending        vs/dos.c
Sending        vs/gpt.c
Sending        vs/mac.c
Sending        vs/sun.c
Transmitting file data .....
Committed revision 117.

Fixed by only checking the first couple of partition table entries.  This
allows some sanity checking while allowing for some missing sectors. If
this is still an issue, we'll need to push down the notion of when we are
testing if data is really a given data type versus when it is specified and
we can be more liberal when we are told that it is a given type and more
conservative with sanity checking when we are guessing. 


----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2874852&group_id=55685