Re: [sleuthkit-developers] Possible bug in tsk_fs_file_read

[Brian C. <ca...@sl...>]

Thanks Michael.  I added bug tracker entries for both of these. The new ENUM settings will probably be added to the next major release. I'll fix the offset for the next minor release.

On Apr 26, 2010, at 10:51 AM, Michael Cohen wrote:

> Hi All,
>  Im currently putting my finishing touches on the new tsk3.x python
> bindings and i noticed some slightly weird behaviour.
> 
> When calling tsk_fs_file_read you can specify flags which are of type
> enum TSK_FS_FILE_READ_FLAG_ENUM this enum can take on two values:
> 
> TSK_FS_FILE_READ_FLAG_SLACK 	Allow read access into slack space. (value 0x01)
> TSK_FS_FILE_READ_FLAG_NOID 	Ignore the Id argument given in the API
> (use only the type). (value 0x02)
> 
> A notable exception is the default case of actually reading the file
> until the end of the file but not including the slack.
> 
> Indeed if i try to read past the end of the file it always gives me
> the slack even if i specify 0 for flags (which is technically not a
> valid value for this enum). I am currently working around this by
> pulling the size of the file and making sure not to read past it and
> into the slack.
> 
> This is the behabiour i can see (my file is 385865 bytes long):
> 
> 1) tsk_fs_file_read( offset =0, length = 10m) -> 385865
> 2) tsk_fs_file_read( offset =385865, length = 10m) -> 7351 (which is the slack)
> 3) tsk_fs_file_read( offset =393216) -> -1
> 
> Should there be a default value for flags (say 0x00) which actually
> stops reading at the end of the file? (in the above step 2 should
> fail?)
> 
> Michael.
> 
> ------------------------------------------------------------------------------
> _______________________________________________
> sleuthkit-developers mailing list
> sle...@li...
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-developers