Re: [sleuthkit-developers] output of ntfs file names.

[Brian C. <ca...@sl...>]

Hi Lee,

Can you point to an example in the code where this happens?  Line number is fine if you have one.  I'm not sure that I am following the problem.

thanks,
brian


On Jan 19, 2011, at 1:46 PM, Lee Ayres wrote:

> In the current version of ntfs.c multiple names are concatenated
> together and separated by white space.   This makes multiple names
> difficult to distinguish from file names with white space in them.  I
> propose that a change be made to the formatting of names for output.
> 
> My understanding is that ntfs allows for any character but null and
> '/'.  Separating the values with '/' characters would seem to me to be
> a compliant choice, however it might confuse users.
> 
> In practice the names could be surrounded with quote characters since
> Windows doesn't allow them and in my experience they are very uncommon
> even in environments and filesystems where they are allowed. If you
> are willing to put just a small bit of cognitive burden on the human
> viewer the name string could be escaped with \" replacing literal
> double quotes and \\ replacing literal backslashes.
> 
> Alternately, the output can have multiple "Name" lines.
> 
> I'm happy to submit a patch that implements any one of the
> alternatives if needs be.
> 
> P.S.  If one wants to get terrifically pedantic, I see nothing to
> indicate that new-lines are disallowed in ntfs file names. Am I wrong
> about that, and if not what effect might that have on the choice of an
> output strategy?
> 
> -- 
> Lee T. Ayres, Senior Analyst
> Interhack Corporation
> http://web.interhack.com/ +1 614 545 4225
> 
> ------------------------------------------------------------------------------
> Protect Your Site and Customers from Malware Attacks
> Learn about various malware tactics and how to avoid them. Understand 
> malware threats, the impact they can have on your business, and how you 
> can protect your company and customers by using code signing.
> http://p.sf.net/sfu/oracle-sfdevnl
> _______________________________________________
> sleuthkit-developers mailing list
> sle...@li...
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-developers