[sleuthkit-developers] [ sleuthkit-Feature Requests-2206306 ] function to map name to inode

[SourceForge.net <no...@so...>]

Feature Requests item #2206306, was opened at 2008-10-28 22:43
Message generated for change (Comment added) made by carrier
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477892&aid=2206306&group_id=55685

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: API
Group: None
Status: Open
Priority: 5
Private: No
Submitted By: Brian Carrier (carrier)
Assigned to: Nobody/Anonymous (nobody)
Summary: function to map name to inode

Initial Comment:
A more formal function should exist to map the name to an inode / metadata address. 

----------------------------------------------------------------------

>Comment By: Brian Carrier (carrier)
Date: 2010-03-30 16:49

Message:
There is the tsk_fs_ffind() method in tsk3/fs/ffind_lib.c that is not very
library friendly and will print the names of the files that use a given
metadata address.  It would be nicer to have a more general approach that
either returns a list of the names or that has a callback so that other
programs can find out the names of a metadata address without needing to
print the data. tsk_fs_ifind_data() has similar needs for improvement
because it too prints the metadata addresses that point to blocks instead
of somehow returning the value to the caller and letting it decide how to
handle the data (print, process, etc.). 

tsk_fs_path2inum() was made more library friendly and returns the metadata
address, but this is an easier problem because there is only one value that
a name can point to.  The challenge with mapping blocks to metadata and
metadata to a name is that there could be multiple values. 

----------------------------------------------------------------------

Comment By: Negin Ahmadian (negin99)
Date: 2010-03-30 08:34

Message:
Dear Mr.Carrier,
Would you please explain more about this issue? What is its usability?
Could you please give me an example.  

Actually I'm doing my graduate thesis about digital forensics field and
need to implement some new features for an open source tool. I've chosen
Autopsy and TSK. 
I read each requested feature detail carefully but couldn't decide what to
implement yet.
I'm familiar with etx3 file system and TSK data structures. I want to know
if you could give me a suggestion.
Thanks a lot in advance.
Best,
Negin

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477892&aid=2206306&group_id=55685