Re: [sleuthkit-developers] Possible bug in tsk_fs_file_read

[Brian C. <ca...@sl...>]

The read issue is fixed.  Thanks.

On Apr 28, 2010, at 4:27 PM, Brian Carrier wrote:

> Thanks Michael.  I added bug tracker entries for both of these. The new ENUM settings will probably be added to the next major release. I'll fix the offset for the next minor release.
> 
> On Apr 26, 2010, at 10:51 AM, Michael Cohen wrote:
> 
>> Hi All,
>> Im currently putting my finishing touches on the new tsk3.x python
>> bindings and i noticed some slightly weird behaviour.
>> 
>> When calling tsk_fs_file_read you can specify flags which are of type
>> enum TSK_FS_FILE_READ_FLAG_ENUM this enum can take on two values:
>> 
>> TSK_FS_FILE_READ_FLAG_SLACK 	Allow read access into slack space. (value 0x01)
>> TSK_FS_FILE_READ_FLAG_NOID 	Ignore the Id argument given in the API
>> (use only the type). (value 0x02)
>> 
>> A notable exception is the default case of actually reading the file
>> until the end of the file but not including the slack.
>> 
>> Indeed if i try to read past the end of the file it always gives me
>> the slack even if i specify 0 for flags (which is technically not a
>> valid value for this enum). I am currently working around this by
>> pulling the size of the file and making sure not to read past it and
>> into the slack.
>> 
>> This is the behabiour i can see (my file is 385865 bytes long):
>> 
>> 1) tsk_fs_file_read( offset =0, length = 10m) -> 385865
>> 2) tsk_fs_file_read( offset =385865, length = 10m) -> 7351 (which is the slack)
>> 3) tsk_fs_file_read( offset =393216) -> -1
>> 
>> Should there be a default value for flags (say 0x00) which actually
>> stops reading at the end of the file? (in the above step 2 should
>> fail?)
>> 
>> Michael.
>> 
>> ------------------------------------------------------------------------------
>> _______________________________________________
>> sleuthkit-developers mailing list
>> sle...@li...
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-developers
> 
> 
> ------------------------------------------------------------------------------
> _______________________________________________
> sleuthkit-developers mailing list
> sle...@li...
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-developers