[sleuthkit-developers] [ sleuthkit-Bugs-3476121 ] Improve globbing for multiple segments

[SourceForge.net <no...@so...>]

Bugs item #3476121, was opened at 2012-01-19 09:21
Message generated for change (Comment added) made by robjoyce
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=3476121&group_id=55685

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: Image File Tools
Group: None
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Rob (robjoyce)
Assigned to: Nobody/Anonymous (nobody)
Summary: Improve globbing for multiple segments

Initial Comment:
TSK recently added the ability to specify only the .E01 file in a segmented EWF image.  The attached patch allows for more than 676 .E01 segments (where .EZZ rolls over to .FAA) by using libewf's globbing function directly.  It also moves the EWF segment globbing to ewf.c so that we don't test for .001 and other segment formats when examining an EWF file (and we don't test for .E01, .E02, etc. when looking at a DD image).

The patch also expands the segment globbing patterns to include .001 (rolling over from .999 to .1000 as FTK does), .01, _001, _01, .000, _000, .00, _00, .aa, .aaa, xaa (from split(1)), and .002.dmgpart (from Apple's hdiutil).

Finally, it changes img_open.c to use split by default when guessing the image type.  If the user doesn't want automatic globbing for more segments, they'd need to specify TSK_IMG_TYPE_RAW_SING.  I'm not sure if that's the best policy, or if auto-globbing should only be enabled if TSK_IMG_TYPE_RAW_SPLIT. But it's a start.

----------------------------------------------------------------------

>Comment By: Rob (robjoyce)
Date: 2012-01-19 09:25

Message:
(The patch is against master as of Jan 13 2012, e5794db.)

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=3476121&group_id=55685