RE: [sleuthkit-developers] Re: IO Subsystem patch for fstools

[Paul B. <ba...@fo...>]

> Excellent.
>=20
> > 4) All filesystem code uses the io object to actually do=20
> the reading.=20
> > e.g.:
> > 	ext2fs->fs_info.io->read_random(ext2fs->fs_info.io, (FS_INFO *)=20
> > ext2fs,(char
> > *) gd, sizeof(ext2fs_gd),offs, "group descriptor");
> >
> > 	the io object has a number of methods. For example:
> > 	io->constructor
>=20
> What is the constructor used for?
>=20
> I quickly looked the changes over.  Is there a need to pass=20
> FS_INFO to=20
> the read functions?  I didn't see you using them and it would be nice=20
> if we could avoid doing that (so that we don't have to restrict=20
> ourselves to file system code).

Well I do see advantages.... I already wanted to ask this...

The problem with the current code is that it is not possible to=20
"read_random" an image efficiently because it cannot check the current
offset in the image.. This results in unnecessary seeks.. And seeks are
very expensive if they come in millions....

For Indexed Searching it would be very handy if their would come either: =
a
generic fs_read_random() function.

If this function would check for the current offset in the image and =
thus not
seek if the reads where all in succession, whis would be great...

Paul Bakker