Re: [sleuthkit-users] New The Sleuth Kit Release!

[Kalin K. <me....@gm...>]

Great!

>> -----Original Message-----
>> From: Brian Carrier [mailto:ca...@sl...]
>>
>> The 4.2.0 release is finally out.  It’s been well over 1.5 years since there was
>> an independent TSK release. There is a lot more in there than what we have
>> listed in the NEWS.txt file because we didn’t keep it up to date with all of the
>> little fixes and changes.
>>

I included an ebuild in my Gentoo overlay, will file a revbump bug
after some more testing.
The Java bindings are not built/enabled, I'll need to work this out.

https://github.com/thinrope/pkalin/tree/master/app-forensics/sleuthkit


Looking at the compiler warnings, I noticed quite a few with yaffs.c
and it may be good to look at those in more detail. I haven't used
YAFFS yet so testing it locally may be a bit of time investment.

Here are the messages in question

libtool: compile:  x86_64-pc-linux-gnu-g++ -DHAVE_CONFIG_H -I.
-I../../tsk -I../.. -I./../.. -Wall -pthread -O2 -pipe -c yaffs.cpp
-fPIC -DPIC -o .libs/yaffs.o
yaffs.cpp: In function ‘void yaffscache_object_dump(FILE*, YaffsCacheObject*)’:
yaffs.cpp:619:30: warning: format ‘%llx’ expects argument of type
‘long long unsigned int’, but argument 6 has type ‘TSK_OFF_T {aka long
int}’ [-Wformat=]
             chunk->ycc_offset);
                              ^
yaffs.cpp: In function ‘uint8_t yaffsfs_parse_image_load_cache(YAFFSFS_INFO*)’:
yaffs.cpp:1524:99: warning: format ‘%x’ expects argument of type
‘unsigned int’, but argument 3 has type ‘TSK_OFF_T {aka long int}’
[-Wformat=]
                     fprintf(stderr, "Error reading header to get
parent id at offset %x\n", offset);

                            ^
yaffs.cpp:1560:16: warning: unused variable ‘orphanParentID’ [-Wunused-variable]
     TSK_INUM_T orphanParentID = yfs->fs_info.last_inum;
                ^
yaffs.cpp: In function ‘uint8_t yaffs_make_deleted(YAFFSFS_INFO*,
TSK_FS_FILE*)’:
yaffs.cpp:1743:95: warning: deprecated conversion from string constant
to ‘char*’ [-Wwrite-strings]
     if (yaffs_make_directory(yaffsfs, fs_file, YAFFS_OBJECT_DELETED,
YAFFS_OBJECT_DELETED_NAME))

                        ^
yaffs.cpp: In function ‘uint8_t yaffs_make_unlinked(YAFFSFS_INFO*,
TSK_FS_FILE*)’:
yaffs.cpp:1765:97: warning: deprecated conversion from string constant
to ‘char*’ [-Wwrite-strings]
     if (yaffs_make_directory(yaffsfs, fs_file, YAFFS_OBJECT_UNLINKED,
YAFFS_OBJECT_UNLINKED_NAME))

                          ^
yaffs.cpp: In function ‘uint8_t yaffs_inode_lookup(TSK_FS_INFO*,
TSK_FS_FILE*, TSK_INUM_T)’:
yaffs.cpp:1876:19: warning: deprecated conversion from string constant
to ‘char*’ [-Wwrite-strings]
         real_name = YAFFS_OBJECT_LOSTNFOUND_NAME;
                   ^
yaffs.cpp:1879:19: warning: deprecated conversion from string constant
to ‘char*’ [-Wwrite-strings]
         real_name = YAFFS_OBJECT_UNLINKED_NAME;
                   ^
yaffs.cpp:1882:19: warning: deprecated conversion from string constant
to ‘char*’ [-Wwrite-strings]
         real_name = YAFFS_OBJECT_DELETED_NAME;
                   ^
yaffs.cpp: In function ‘TSK_FS_INFO* yaffs2_open(TSK_IMG_INFO*,
TSK_OFF_T, TSK_FS_TYPE_ENUM, uint8_t)’:
yaffs.cpp:1580:39: warning: ‘max_inum’ may be used uninitialized in
this function [-Wmaybe-uninitialized]
     yfs->fs_info.last_inum = max_inum + 1; // One more for the orphan dir
                                       ^
yaffs.cpp:1578:16: note: ‘max_inum’ was declared here
     TSK_INUM_T max_inum;
                ^
yaffs.cpp: At global scope:
yaffs.cpp:626:5: warning: ‘void yaffscache_objects_dump(FILE*,
YAFFSFS_INFO*)’ defined but not used [-Wunused-function]
     yaffscache_objects_dump(FILE *fp, YAFFSFS_INFO *yfs)
     ^


Kalin.