sleuthkit-developers — A list to discuss development of new features of The Sleuth Kit and Autopsy

[sleuthkit-developers] [ sleuthkit-Feature Requests-3558646 ] Add MD5 hash support to mac-robber

[SourceForge.net <no...@so...>]

Feature Requests item #3558646, was opened at 2012-08-16 17:30
Message generated for change (Tracker Item Submitted) made by sbonds
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477892&aid=3558646&group_id=55685

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: Timeline
Group: None
Status: Open
Priority: 5
Private: No
Submitted By: Steve Bonds (sbonds)
Assigned to: Nobody/Anonymous (nobody)
Summary: Add MD5 hash support to mac-robber

Initial Comment:
Currently mac-robber, the standalone utility for computing a mactime "body" file, does not support MD5 hash calculation even though the file format has a field for it.

The attached patch remedies that situation, but requires libssl (OpenSSL) be present and linked during the build.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477892&aid=3558646&group_id=55685

[sleuthkit-developers] [ sleuthkit-Bugs-3554592 ] Error compiling TSK framework

[SourceForge.net <no...@so...>]

Bugs item #3554592, was opened at 2012-08-05 12:00
Message generated for change (Settings changed) made by jlam03
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=3554592&group_id=55685

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: None
Status: Open
Resolution: None
>Priority: 3
Private: No
Submitted By: Jonathan (jlam03)
Assigned to: Nobody/Anonymous (nobody)
Summary: Error compiling TSK framework

Initial Comment:
I am compiling the STK framework in Windows, using the solution file in framework/win32/framework/, as well as the FileTypeSig module.  I encounter the following errors:
>
> 1. LINK: Fatal error LNK1104- cannot open file 'libtskframework.lib'.  I search the directory and can not find this file.
> 2. I set TSK_HOME as well as POCO_HOME in my environment.
> 3. warning:  class 'std::....." needs to have dll-interface to be used by clients of class TskModule.
>
> I am stuck.  I rebuild the sleuthkit, times and times as well as all the requiered POCO modules, and the framework.

Any help would be greately appreciated.  Don't know how to get the libtskframework.lib

Thank you

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=3554592&group_id=55685

[sleuthkit-developers] [ sleuthkit-Bugs-3554592 ] Error compiling TSK framework

[SourceForge.net <no...@so...>]

Bugs item #3554592, was opened at 2012-08-05 12:00
Message generated for change (Tracker Item Submitted) made by jlam03
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=3554592&group_id=55685

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: None
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Jonathan (jlam03)
Assigned to: Nobody/Anonymous (nobody)
Summary: Error compiling TSK framework

Initial Comment:
I am compiling the STK framework in Windows, using the solution file in framework/win32/framework/, as well as the FileTypeSig module.  I encounter the following errors:
>
> 1. LINK: Fatal error LNK1104- cannot open file 'libtskframework.lib'.  I search the directory and can not find this file.
> 2. I set TSK_HOME as well as POCO_HOME in my environment.
> 3. warning:  class 'std::....." needs to have dll-interface to be used by clients of class TskModule.
>
> I am stuck.  I rebuild the sleuthkit, times and times as well as all the requiered POCO modules, and the framework.

Any help would be greately appreciated.  Don't know how to get the libtskframework.lib

Thank you

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=3554592&group_id=55685

[sleuthkit-developers] [ sleuthkit-Bugs-3553704 ] Error when compiling SKT 3.2.2

[SourceForge.net <no...@so...>]

Bugs item #3553704, was opened at 2012-08-02 10:52
Message generated for change (Tracker Item Submitted) made by jlam03
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=3553704&group_id=55685

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: Other
Group: None
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Jonathan (jlam03)
Assigned to: Nobody/Anonymous (nobody)
Summary: Error when compiling SKT 3.2.2

Initial Comment:
Attempting to compile Sleuthkit 3.2.2 win32 on Windows 7, Visual Studion 2010, and came across these errors. (BTW, I posted to the Requested Feature by mistake, so repost it here.  My apology).  Any help would be great as this is for my final project in Digita Forensics class.

C:\Program Files\MSBuild\Microsoft.Cpp\v4.0\Microsoft.CppCommon.targets(113,5): error MSB3073:
The command "copy "c:\Digital_Forensics\Project\libewf-20120603msvscpp\release\libewf.dll"
"C:\Digital_Forensics\Project\sleuthkit-sleuthkit-9b83edc\win32\Debug\"
C:\Program Files\MSBuild\Microsoft.Cpp\v4.0\Microsoft.CppCommon.targets(113,5): error MSB3073:
IF EXIST "c:\Digital_Forensics\Project\libewf-20120603\msvscpp\zlib-1.2.6" (
C:\Program Files\MSBuild\Microsoft.Cpp\v4.0\Microsoft.CppCommon.targets(113,5): error MSB3073:
xcopy "c:\Digital_Forensics\Project\libewf-20120603\msvscpp\Release\zlib.dll"
"C:\Digital_Forensics\Project\sleuthkit-sleuthkit-9b83edc\win32\Debug\" /R /Y
C:\Program Files\MSBuild\Microsoft.Cpp\v4.0\Microsoft.CppCommon.targets(113,5): error MSB3073:
) ELSE (
C:\Program Files\MSBuild\Microsoft.Cpp\v4.0\Microsoft.CppCommon.targets(113,5): error MSB3073:
xcopy "c:\Digital_Forensics\Project\libewf-20120603\msvscpp\zlib\zlib1.dll"
"C:\Digital_Forensics\Project\sleuthkit-sleuthkit-9b83edc\win32\Debug\" /R /Y
C:\Program Files\MSBuild\Microsoft.Cpp\v4.0\Microsoft.CppCommon.targets(113,5): error MSB3073:
)
C:\Program Files\MSBuild\Microsoft.Cpp\v4.0\Microsoft.CppCommon.targets(113,5): error MSB3073:
C:\Program Files\MSBuild\Microsoft.Cpp\v4.0\Microsoft.CppCommon.targets(113,5): error MSB3073:
:VCEnd" exited with code 4.
Build FAILED.
Time Elapsed 00:00:29.59

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=3553704&group_id=55685

[sleuthkit-developers] [ sleuthkit-Feature Requests-3553700 ] Error when compiling SKT 3.2.2

[SourceForge.net <no...@so...>]

Feature Requests item #3553700, was opened at 2012-08-02 10:45
Message generated for change (Tracker Item Submitted) made by jlam03
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477892&aid=3553700&group_id=55685

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: Other
Group: None
Status: Open
Priority: 5
Private: No
Submitted By: Jonathan (jlam03)
Assigned to: Nobody/Anonymous (nobody)
Summary: Error when compiling SKT 3.2.2

Initial Comment:
I encountered the following error messages while attempting to compile 3.2.2 on Windows 7 using Visual Studio 2010.  Any help would be appreciated.
auto.cpp
walk_cpp.cpp
Generating Code...
Lib:
libtsk.vcxproj -> C:\Digital_Forensics\Project\sleuthkit-sleuthkit-
9b83edc\win32\Debug\libtsk.lib
PostBuildEvent:
The system cannot find the path specified.
File not found - zlib1.dll
0 File(s) copied
C:\Program Files\MSBuild\Microsoft.Cpp\v4.0\Microsoft.CppCommon.targets(113,5): error MSB3073:
The command "copy "c:\Digital_Forensics\Project\libewf-20120603msvscpp\release\libewf.dll"
"C:\Digital_Forensics\Project\sleuthkit-sleuthkit-9b83edc\win32\Debug\"
C:\Program Files\MSBuild\Microsoft.Cpp\v4.0\Microsoft.CppCommon.targets(113,5): error MSB3073:
IF EXIST "c:\Digital_Forensics\Project\libewf-20120603\msvscpp\zlib-1.2.6" (
C:\Program Files\MSBuild\Microsoft.Cpp\v4.0\Microsoft.CppCommon.targets(113,5): error MSB3073:
xcopy "c:\Digital_Forensics\Project\libewf-20120603\msvscpp\Release\zlib.dll"
"C:\Digital_Forensics\Project\sleuthkit-sleuthkit-9b83edc\win32\Debug\" /R /Y
C:\Program Files\MSBuild\Microsoft.Cpp\v4.0\Microsoft.CppCommon.targets(113,5): error MSB3073:
) ELSE (
C:\Program Files\MSBuild\Microsoft.Cpp\v4.0\Microsoft.CppCommon.targets(113,5): error MSB3073:
xcopy "c:\Digital_Forensics\Project\libewf-20120603\msvscpp\zlib\zlib1.dll"
"C:\Digital_Forensics\Project\sleuthkit-sleuthkit-9b83edc\win32\Debug\" /R /Y
C:\Program Files\MSBuild\Microsoft.Cpp\v4.0\Microsoft.CppCommon.targets(113,5): error MSB3073:
)
C:\Program Files\MSBuild\Microsoft.Cpp\v4.0\Microsoft.CppCommon.targets(113,5): error MSB3073:
C:\Program Files\MSBuild\Microsoft.Cpp\v4.0\Microsoft.CppCommon.targets(113,5): error MSB3073:
:VCEnd" exited with code 4.
Build FAILED.
Time Elapsed 00:00:29.59

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477892&aid=3553700&group_id=55685

[sleuthkit-developers] [ sleuthkit-Feature Requests-3547142 ] javac detection in beta 4.0

[SourceForge.net <no...@so...>]

Feature Requests item #3547142, was opened at 2012-07-21 22:50
Message generated for change (Tracker Item Submitted) made by jbmetz
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477892&aid=3547142&group_id=55685

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: None
Status: Open
Priority: 5
Private: No
Submitted By: Joachim Metz (jbmetz)
Assigned to: Nobody/Anonymous (nobody)
Summary: javac detection in beta 4.0

Initial Comment:
Small issue but on OSX the javac detecting in ./configure triggers a "Would you like to install javac" popup.
Can you add a configure option to disable (or preferable enable when necessary) the javac check.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477892&aid=3547142&group_id=55685

Re: [sleuthkit-developers] HTML Text Extraction of comments, script, etc.

[Derrick K. <dk...@gm...>]

I'll second Alex's recommendation on BeautifulSoup.  We've been using
it for various projects and it works well.

  >>> from bs4 import BeautifulSoup
  >>> HTML = '<font>b</font><font>a</font><font>d</font>'
  >>> soup = BeautifulSoup(HTML)
  >>> soup.get_text()
  'bad'
  >>>
  >>> for link in soup.find_all('font'):
  ...     print(link.contents)
  ...
  ['b']
  ['a']
  ['d']

Derrick


On Wed, Jun 6, 2012 at 1:08 PM, Alex Nelson <ajn...@cs...> wrote:
> Hi Brian,
>
> Beautiful Soup also seems to be able to handle that "bad" search scenario.  Search for the string "Another common task is extracting all the text from a page" on the doc page.
> <http://www.crummy.com/software/BeautifulSoup/bs4/doc/>
>
> --Alex
>
>
> On Jun 6, 2012, at 12:05 , Brian Carrier wrote:
>
>> Hi Luis.  The challenge with strings and html is that if you have "<font>b</font><font>a</font><font>d</font>" and search for the word "bad", then you won't find it.  We want to intelligently parse the HTML, but separate the text associated with comments and script from the main body.
>>
>>
>> On Jun 6, 2012, at 2:58 PM, Luis Gómez Miralles wrote:
>>
>>> Why not something as simple as:
>>> strings -a file.html
>>>
>>> Not kidding. In our Revealer Toolkit
>>> (code.google.com/p/revealertoolkit) we do something similar to extract
>>> all recognizable text from many file types; however we do it with
>>> fstrings, a tool we coded (you can find the source in the CVS repo,
>>> for instance under
>>> http://code.google.com/p/revealertoolkit/source/browse/tags/RVT_v0.2.1/tools/f-strings.c
>>> ; we haven't changed that code for years).
>>>
>>> In case anyone is interested, the tool differs from a normal "strings"
>>> binary in the following points:
>>> - it will treat any ASCII,UTF-8 and/or UTF-16 it can find in the file.
>>> You don't have to choose one encoding (i.e. you don't have to specify
>>> the encoding, as you'd do with the strings "-e" parameter).
>>> - all the output is lower-case, so that if you want to grep it later,
>>> you don't need the grep "-i" switch. We found that grepping with "-i"
>>> took a lot more time (about 10x the time IIRC, but it's been 4-5 years
>>> since we checked it, so I may be missing something).
>>> - finally, it will transform some special characters; for instance:
>>> (à, á, ä... turn into "a"; ç turns into "c", ñ into "n", etc.
>>>
>>> Obviously it is tailored to some of our specific needs for the cases
>>> we handle. Thus, right now it wouldn't be suitable to treat files with
>>> Arabic, Chinese, or other different character sets. Apart from that,
>>> it's OK for us.
>>>
>>> Hope anyone can use this!
>>>
>>> Best regards
>>>
>>> Pope
>>>
>>>
>>> El 06/06/2012, a las 20:22, Brian Carrier <ca...@sl...> escribió:
>>>
>>>> Anyone know of an open source library that extracts text from HTML files including the comments, java script etc?  We're playing with SOLR/Tika and its HTML extraction will only output the file's text and not the other stuff.
>>>>
>>>> thanks,
>>>> brian
>>>>
>>>>
>>>> ------------------------------------------------------------------------------
>>>> Live Security Virtual Conference
>>>> Exclusive live event will cover all the ways today's security and
>>>> threat landscape has changed and how IT managers can respond. Discussions
>>>> will include endpoint security, mobile security and the latest in malware
>>>> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
>>>> _______________________________________________
>>>> sleuthkit-developers mailing list
>>>> sle...@li...
>>>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-developers
>>
>>
>> ------------------------------------------------------------------------------
>> Live Security Virtual Conference
>> Exclusive live event will cover all the ways today's security and
>> threat landscape has changed and how IT managers can respond. Discussions
>> will include endpoint security, mobile security and the latest in malware
>> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
>> _______________________________________________
>> sleuthkit-developers mailing list
>> sle...@li...
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-developers
>
>
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond. Discussions
> will include endpoint security, mobile security and the latest in malware
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> sleuthkit-developers mailing list
> sle...@li...
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-developers

Re: [sleuthkit-developers] HTML Text Extraction of comments, script, etc.

[Alex N. <ajn...@cs...>]

Hi Brian,

Beautiful Soup also seems to be able to handle that "bad" search scenario.  Search for the string "Another common task is extracting all the text from a page" on the doc page.
<http://www.crummy.com/software/BeautifulSoup/bs4/doc/>

--Alex


On Jun 6, 2012, at 12:05 , Brian Carrier wrote:

> Hi Luis.  The challenge with strings and html is that if you have "<font>b</font><font>a</font><font>d</font>" and search for the word "bad", then you won't find it.  We want to intelligently parse the HTML, but separate the text associated with comments and script from the main body.
> 
> 
> On Jun 6, 2012, at 2:58 PM, Luis Gómez Miralles wrote:
> 
>> Why not something as simple as:
>> strings -a file.html
>> 
>> Not kidding. In our Revealer Toolkit
>> (code.google.com/p/revealertoolkit) we do something similar to extract
>> all recognizable text from many file types; however we do it with
>> fstrings, a tool we coded (you can find the source in the CVS repo,
>> for instance under
>> http://code.google.com/p/revealertoolkit/source/browse/tags/RVT_v0.2.1/tools/f-strings.c
>> ; we haven't changed that code for years).
>> 
>> In case anyone is interested, the tool differs from a normal "strings"
>> binary in the following points:
>> - it will treat any ASCII,UTF-8 and/or UTF-16 it can find in the file.
>> You don't have to choose one encoding (i.e. you don't have to specify
>> the encoding, as you'd do with the strings "-e" parameter).
>> - all the output is lower-case, so that if you want to grep it later,
>> you don't need the grep "-i" switch. We found that grepping with "-i"
>> took a lot more time (about 10x the time IIRC, but it's been 4-5 years
>> since we checked it, so I may be missing something).
>> - finally, it will transform some special characters; for instance:
>> (à, á, ä... turn into "a"; ç turns into "c", ñ into "n", etc.
>> 
>> Obviously it is tailored to some of our specific needs for the cases
>> we handle. Thus, right now it wouldn't be suitable to treat files with
>> Arabic, Chinese, or other different character sets. Apart from that,
>> it's OK for us.
>> 
>> Hope anyone can use this!
>> 
>> Best regards
>> 
>> Pope
>> 
>> 
>> El 06/06/2012, a las 20:22, Brian Carrier <ca...@sl...> escribió:
>> 
>>> Anyone know of an open source library that extracts text from HTML files including the comments, java script etc?  We're playing with SOLR/Tika and its HTML extraction will only output the file's text and not the other stuff.
>>> 
>>> thanks,
>>> brian
>>> 
>>> 
>>> ------------------------------------------------------------------------------
>>> Live Security Virtual Conference
>>> Exclusive live event will cover all the ways today's security and
>>> threat landscape has changed and how IT managers can respond. Discussions
>>> will include endpoint security, mobile security and the latest in malware
>>> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
>>> _______________________________________________
>>> sleuthkit-developers mailing list
>>> sle...@li...
>>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-developers
> 
> 
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and 
> threat landscape has changed and how IT managers can respond. Discussions 
> will include endpoint security, mobile security and the latest in malware 
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> sleuthkit-developers mailing list
> sle...@li...
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-developers

Re: [sleuthkit-developers] HTML Text Extraction of comments, script, etc.

[Brian C. <ca...@sl...>]

Thanks.  We'll check that out.

brian

On Jun 6, 2012, at 2:59 PM, Alex Nelson wrote:

> Hi Brian,
> 
> We've been trying the Python library Beautiful Soup, which has a pretty good track record ("Hall of Fame") on its front page.
> <http://www.crummy.com/software/BeautifulSoup/>
> 
> This section in particular looks like what you're looking for.
> <http://www.crummy.com/software/BeautifulSoup/bs4/doc/#comments-and-other-special-strings>
> 
> --Alex
> 
> 
> On Jun 6, 2012, at 11:21 , Brian Carrier wrote:
> 
>> Anyone know of an open source library that extracts text from HTML files including the comments, java script etc?  We're playing with SOLR/Tika and its HTML extraction will only output the file's text and not the other stuff.
>> 
>> thanks,
>> brian
>> 
>> 
>> ------------------------------------------------------------------------------
>> Live Security Virtual Conference
>> Exclusive live event will cover all the ways today's security and 
>> threat landscape has changed and how IT managers can respond. Discussions 
>> will include endpoint security, mobile security and the latest in malware 
>> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
>> _______________________________________________
>> sleuthkit-developers mailing list
>> sle...@li...
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-developers
> 

Re: [sleuthkit-developers] HTML Text Extraction of comments, script, etc.

[Brian C. <ca...@sl...>]

Hi Luis.  The challenge with strings and html is that if you have "<font>b</font><font>a</font><font>d</font>" and search for the word "bad", then you won't find it.  We want to intelligently parse the HTML, but separate the text associated with comments and script from the main body.


On Jun 6, 2012, at 2:58 PM, Luis Gómez Miralles wrote:

> Why not something as simple as:
> strings -a file.html
> 
> Not kidding. In our Revealer Toolkit
> (code.google.com/p/revealertoolkit) we do something similar to extract
> all recognizable text from many file types; however we do it with
> fstrings, a tool we coded (you can find the source in the CVS repo,
> for instance under
> http://code.google.com/p/revealertoolkit/source/browse/tags/RVT_v0.2.1/tools/f-strings.c
> ; we haven't changed that code for years).
> 
> In case anyone is interested, the tool differs from a normal "strings"
> binary in the following points:
> - it will treat any ASCII,UTF-8 and/or UTF-16 it can find in the file.
> You don't have to choose one encoding (i.e. you don't have to specify
> the encoding, as you'd do with the strings "-e" parameter).
> - all the output is lower-case, so that if you want to grep it later,
> you don't need the grep "-i" switch. We found that grepping with "-i"
> took a lot more time (about 10x the time IIRC, but it's been 4-5 years
> since we checked it, so I may be missing something).
> - finally, it will transform some special characters; for instance:
> (à, á, ä... turn into "a"; ç turns into "c", ñ into "n", etc.
> 
> Obviously it is tailored to some of our specific needs for the cases
> we handle. Thus, right now it wouldn't be suitable to treat files with
> Arabic, Chinese, or other different character sets. Apart from that,
> it's OK for us.
> 
> Hope anyone can use this!
> 
> Best regards
> 
> Pope
> 
> 
> El 06/06/2012, a las 20:22, Brian Carrier <ca...@sl...> escribió:
> 
>> Anyone know of an open source library that extracts text from HTML files including the comments, java script etc?  We're playing with SOLR/Tika and its HTML extraction will only output the file's text and not the other stuff.
>> 
>> thanks,
>> brian
>> 
>> 
>> ------------------------------------------------------------------------------
>> Live Security Virtual Conference
>> Exclusive live event will cover all the ways today's security and
>> threat landscape has changed and how IT managers can respond. Discussions
>> will include endpoint security, mobile security and the latest in malware
>> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
>> _______________________________________________
>> sleuthkit-developers mailing list
>> sle...@li...
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-developers

Re: [sleuthkit-developers] HTML Text Extraction of comments, script, etc.

[Alex N. <ajn...@cs...>]

Hi Brian,

We've been trying the Python library Beautiful Soup, which has a pretty good track record ("Hall of Fame") on its front page.
<http://www.crummy.com/software/BeautifulSoup/>

This section in particular looks like what you're looking for.
<http://www.crummy.com/software/BeautifulSoup/bs4/doc/#comments-and-other-special-strings>

--Alex


On Jun 6, 2012, at 11:21 , Brian Carrier wrote:

> Anyone know of an open source library that extracts text from HTML files including the comments, java script etc?  We're playing with SOLR/Tika and its HTML extraction will only output the file's text and not the other stuff.
> 
> thanks,
> brian
> 
> 
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and 
> threat landscape has changed and how IT managers can respond. Discussions 
> will include endpoint security, mobile security and the latest in malware 
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> sleuthkit-developers mailing list
> sle...@li...
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-developers

Re: [sleuthkit-developers] HTML Text Extraction of comments, script, etc.

[Luis G. M. <el...@gm...>]

Why not something as simple as:
strings -a file.html

Not kidding. In our Revealer Toolkit
(code.google.com/p/revealertoolkit) we do something similar to extract
all recognizable text from many file types; however we do it with
fstrings, a tool we coded (you can find the source in the CVS repo,
for instance under
http://code.google.com/p/revealertoolkit/source/browse/tags/RVT_v0.2.1/tools/f-strings.c
; we haven't changed that code for years).

In case anyone is interested, the tool differs from a normal "strings"
binary in the following points:
- it will treat any ASCII,UTF-8 and/or UTF-16 it can find in the file.
You don't have to choose one encoding (i.e. you don't have to specify
the encoding, as you'd do with the strings "-e" parameter).
- all the output is lower-case, so that if you want to grep it later,
you don't need the grep "-i" switch. We found that grepping with "-i"
took a lot more time (about 10x the time IIRC, but it's been 4-5 years
since we checked it, so I may be missing something).
- finally, it will transform some special characters; for instance:
(à, á, ä... turn into "a"; ç turns into "c", ñ into "n", etc.

Obviously it is tailored to some of our specific needs for the cases
we handle. Thus, right now it wouldn't be suitable to treat files with
Arabic, Chinese, or other different character sets. Apart from that,
it's OK for us.

Hope anyone can use this!

Best regards

Pope


El 06/06/2012, a las 20:22, Brian Carrier <ca...@sl...> escribió:

> Anyone know of an open source library that extracts text from HTML files including the comments, java script etc?  We're playing with SOLR/Tika and its HTML extraction will only output the file's text and not the other stuff.
>
> thanks,
> brian
>
>
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond. Discussions
> will include endpoint security, mobile security and the latest in malware
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> sleuthkit-developers mailing list
> sle...@li...
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-developers

[sleuthkit-developers] HTML Text Extraction of comments, script, etc.

[Brian C. <ca...@sl...>]

Anyone know of an open source library that extracts text from HTML files including the comments, java script etc?  We're playing with SOLR/Tika and its HTML extraction will only output the file's text and not the other stuff.

thanks,
brian

[sleuthkit-developers] [ sleuthkit-Bugs-3267504 ] split_open > split_close leaks memory

[SourceForge.net <no...@so...>]

Bugs item #3267504, was opened at 2011-04-01 08:20
Message generated for change (Settings changed) made by carrier
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=3267504&group_id=55685

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: Image File Tools
Group: None
>Status: Closed
>Resolution: Wont Fix
Priority: 5
Private: No
Submitted By: parki (lolwutlol)
Assigned to: Raman (rarora05)
Summary: split_open > split_close leaks memory

Initial Comment:
Brian, I've been doing some profiling and found that:

split_info->max_off is being malloc'ed at line 372 of split.c

But not free'd at split_close(). I haven't looked thoroughly to see if it breaks anything but it looks like a free() at line 322-323 solves it.

Also, I haven't experienced it so far, but it looks that code under the condition at line 403 of split.c (checking if an image name is a directory and returning NULL) isn't freeing memory either and would be leaking.

----------------------------------------------------------------------

>Comment By: Brian Carrier (carrier)
Date: 2012-05-09 14:00

Message:
I think these are all addressed in the new merged raw.c file from Rob
Joyce.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=3267504&group_id=55685

[sleuthkit-developers] [ sleuthkit-Bugs-3476125 ] Fix build on MinGW

[SourceForge.net <no...@so...>]

Bugs item #3476125, was opened at 2012-01-19 09:24
Message generated for change (Comment added) made by carrier
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=3476125&group_id=55685

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: None
>Status: Closed
>Resolution: Wont Fix
Priority: 5
Private: No
Submitted By: Rob (robjoyce)
Assigned to: Nobody/Anonymous (nobody)
Summary: Fix build on MinGW

Initial Comment:
The master branch of TSK (at least as of last Friday) doesn't build on MinGW.  The attached patch fixes this.  (It also makes the threading test compile on Windows.  Haven't tested that the test actually passes, but at least it doesn't stop the build now.)

The patch is against master as of last Friday, e5794db.

----------------------------------------------------------------------

>Comment By: Brian Carrier (carrier)
Date: 2012-05-09 13:57

Message:
This seems to have all been integrated with a github pull request from Rob.

----------------------------------------------------------------------

Comment By: Rob (robjoyce)
Date: 2012-01-19 10:59

Message:
Forgot to mention: in order for the build to work in MinGW, the Java JDK
needs to be in a path that doesn't have spaces (ie, not C:\Program
Files\Java\jdk...\).

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=3476125&group_id=55685

[sleuthkit-developers] [ sleuthkit-Bugs-3453765 ] make tsk_fs_time_to_str buffer longer

[SourceForge.net <no...@so...>]

Bugs item #3453765, was opened at 2011-12-07 09:58
Message generated for change (Settings changed) made by carrier
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=3453765&group_id=55685

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: File System Tools
Group: None
>Status: Closed
>Resolution: Fixed
Priority: 5
Private: No
Submitted By: Brian Carrier (carrier)
Assigned to: Nobody/Anonymous (nobody)
Summary: make tsk_fs_time_to_str buffer longer

Initial Comment:
Currently, tsk_fs_time_to_str requires that a 32-byte buffer (or greater) be passed in. This is true for most platforms, but it seems that Windows will make long versions of the timzeone (Eastern Standard) instead of (EST).  So, the buffer size needs to be increased in all the places that call it.


----------------------------------------------------------------------

>Comment By: Brian Carrier (carrier)
Date: 2012-05-09 13:53

Message:
Checked into master. 

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=3453765&group_id=55685

[sleuthkit-developers] [ sleuthkit-Bugs-3476121 ] Improve globbing for multiple segments

[SourceForge.net <no...@so...>]

Bugs item #3476121, was opened at 2012-01-19 09:21
Message generated for change (Comment added) made by carrier
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=3476121&group_id=55685

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: Image File Tools
Group: None
>Status: Closed
>Resolution: Fixed
Priority: 5
Private: No
Submitted By: Rob (robjoyce)
Assigned to: Nobody/Anonymous (nobody)
Summary: Improve globbing for multiple segments

Initial Comment:
TSK recently added the ability to specify only the .E01 file in a segmented EWF image.  The attached patch allows for more than 676 .E01 segments (where .EZZ rolls over to .FAA) by using libewf's globbing function directly.  It also moves the EWF segment globbing to ewf.c so that we don't test for .001 and other segment formats when examining an EWF file (and we don't test for .E01, .E02, etc. when looking at a DD image).

The patch also expands the segment globbing patterns to include .001 (rolling over from .999 to .1000 as FTK does), .01, _001, _01, .000, _000, .00, _00, .aa, .aaa, xaa (from split(1)), and .002.dmgpart (from Apple's hdiutil).

Finally, it changes img_open.c to use split by default when guessing the image type.  If the user doesn't want automatic globbing for more segments, they'd need to specify TSK_IMG_TYPE_RAW_SING.  I'm not sure if that's the best policy, or if auto-globbing should only be enabled if TSK_IMG_TYPE_RAW_SPLIT. But it's a start.

----------------------------------------------------------------------

>Comment By: Brian Carrier (carrier)
Date: 2012-05-08 11:09

Message:
This patch was integrated as a github pull request. 

----------------------------------------------------------------------

Comment By: Rob (robjoyce)
Date: 2012-01-19 09:25

Message:
(The patch is against master as of Jan 13 2012, e5794db.)

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=3476121&group_id=55685

[sleuthkit-developers] [ sleuthkit-Bugs-3481447 ] Failing to build on OSX Lion, current XCode

[SourceForge.net <no...@so...>]

Bugs item #3481447, was opened at 2012-01-29 16:34
Message generated for change (Comment added) made by carrier
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=3481447&group_id=55685

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: None
>Status: Closed
>Resolution: Fixed
Priority: 5
Private: No
Submitted By: Benson Margulies (bensonmargulies)
Assigned to: Nobody/Anonymous (nobody)
Summary: Failing to build on OSX Lion, current XCode

Initial Comment:
bin/sh ../../libtool --tag=CC   --mode=compile gcc -DHAVE_CONFIG_H -I. -I../../tsk3    -I../.. -Wall  -g -O2 -D_THREAD_SAFE -pthread -I/usr/local/include -MT md5c.lo -MD -MP -MF .deps/md5c.Tpo -c -o md5c.lo md5c.c
libtool: Version mismatch error.  This is libtool 2.2.10, but the
libtool: definition of this LT_INIT comes from libtool 2.2.4.
libtool: You should recreate aclocal.m4 with macros from libtool 2.2.10
libtool: and run autoconf again.
make[3]: *** [md5c.lo] Error 63
make[2]: *** [all-recursive] Error 1
make[1]: *** [all] Error 2
make: *** [all-recursive] Error 1
█▓▒░benson@tinfoilhat░▒▓██▓▒░ Sun Jan 29 07:30:25P 
~/x/sleuthkit/ autoconf
aclocal.m4:14: error: this file was generated for autoconf 2.61.
You have another version of autoconf.  If you want to use that,
you should regenerate the build system entirely.
aclocal.m4:14: the top level
autom4te: /opt/local/bin/gm4 failed with exit status: 63
█▓▒░benson@tinfoilhat░▒▓██▓▒░ Sun Jan 29 07:30:34P 
~/x/sleuthkit/ aquamacs Makefile 
█▓▒░benson@tinfoilhat░▒▓██▓▒░ Sun Jan 29 07:30:45P 
~/x/sleuthkit/ make am-refresh
make: *** No rule to make target `am-refresh'.  Stop.
█▓▒░benson@tinfoilhat░▒▓██▓▒░ Sun Jan 29 07:31:16P 
~/x/sleuthkit/ make am-refresh
make: *** No rule to make target `am-refresh'.  Stop.
█▓▒░benson@tinfoilhat░▒▓██▓▒░ Sun Jan 29 07:31:20P 
~/x/sleuthkit/ make am--refresh
█▓▒░benson@tinfoilhat░▒▓██▓▒░ Sun Jan 29 07:31:24P 
~/x/sleuthkit/ which libtool
/usr/bin/libtool
█▓▒░benson@tinfoilhat░▒▓██▓▒░ Sun Jan 29 07:34:22P 
~/x/sleuthkit/ ls /opt/local/bin/libtool
ls: /opt/local/bin/libtool: No such file or directory
█▓▒░benson@tinfoilhat░▒▓██▓▒░ Sun Jan 29 07:34:28P 
█▓▒░benson@tinfoilhat░▒▓██▓▒░ Sun Jan 29 07:34:33P 
~/x/sleuthkit/ 


----------------------------------------------------------------------

>Comment By: Brian Carrier (carrier)
Date: 2012-05-08 11:08

Message:
README was updated to reflect re-running bootstrap if libtool and such are
complaining.  

In the case of OS X, it no longer comes with libtool and auto*, so those
need to be installed to run bootstrap.

----------------------------------------------------------------------

Comment By: Benson Margulies (bensonmargulies)
Date: 2012-01-29 16:45

Message:
The version of libtool that configure drops into the tree is 2.2.10. So it
looks to me as if the current tip is not in a consistent state.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=3481447&group_id=55685

[sleuthkit-developers] [ sleuthkit-Bugs-3481464 ] errors_test.h missing from git

[SourceForge.net <no...@so...>]

Bugs item #3481464, was opened at 2012-01-29 17:05
Message generated for change (Comment added) made by carrier
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=3481464&group_id=55685

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: None
>Status: Closed
Resolution: None
Priority: 5
Private: No
Submitted By: Benson Margulies (bensonmargulies)
Assigned to: Nobody/Anonymous (nobody)
Summary: errors_test.h missing from git

Initial Comment:
errors_test.cpp is there. errors_test.h is not.

g++ -DHAVE_CONFIG_H -I. -I../../tsk3  -I../.. -Wall -I/usr/local/include    -g -O2 -c -o errors_test.o errors_test.cpp
errors_test.cpp:23:25: error: errors_test.h: No such file or directory
errors_test.cpp:26: error: expected constructor, destructor, or type conversion before ‘(’ token
errors_test.cpp:28: error: ‘ErrorsTest’ has not been declared
errors_test.cpp:29: error: ‘ErrorsTest’ has not been declared
errors_test.cpp:31: error: ‘ErrorsTest’ has not been declared
errors_test.cpp: In function ‘void testInitialState()’:
errors_test.cpp:35: error: ‘CPPUNIT_ASSERT’ was not declared in this scope
errors_test.cpp: At global scope:
errors_test.cpp:40: error: ‘ErrorsTest’ has not been declared
errors_test.cpp: In function ‘void testLengthChecks()’:
errors_test.cpp:50: error: ‘CPPUNIT_ASSERT’ was not declared in this scope
errors_test.cpp: At global scope:
errors_test.cpp:115: error: ‘ErrorsTest’ has not been declared
errors_test.cpp: In function ‘void testMultithreaded()’:
errors_test.cpp:125: error: ‘CPPUNIT_FAIL’ was not declared in this scope
errors_test.cpp:139: error: ‘CPPUNIT_FAIL’ was not declared in this scope
errors_test.cpp:146: error: ‘CPPUNIT_FAIL’ was not declared in this scope
errors_test.cpp:152: error: ‘CPPUNIT_FAIL’ was not declared in this scope
errors_test.cpp:167: error: ‘CPPUNIT_ASSERT’ was not declared in this scope
errors_test.cpp:175: error: ‘CPPUNIT_FAIL’ was not declared in this scope
errors_test.cpp:188: error: ‘CPPUNIT_FAIL’ was not declared in this scope
make: *** [errors_test.o] Error 1

----------------------------------------------------------------------

>Comment By: Brian Carrier (carrier)
Date: 2012-05-08 11:02

Message:
This was fixed.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=3481464&group_id=55685

[sleuthkit-developers] [ sleuthkit-Feature Requests-3197980 ] Specify only first image in split

[SourceForge.net <no...@so...>]

Feature Requests item #3197980, was opened at 2011-03-02 16:38
Message generated for change (Settings changed) made by carrier
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477892&aid=3197980&group_id=55685

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: Image Layer
Group: None
>Status: Closed
Priority: 5
Private: No
Submitted By: Brian Carrier (carrier)
Assigned to: Raman (rarora05)
Summary: Specify only first image in split

Initial Comment:
The user should be able to specify only the first image in a split image or E01 set and TSK will test for the follow in files. 

----------------------------------------------------------------------

>Comment By: Brian Carrier (carrier)
Date: 2012-05-08 07:52

Message:
Fixed on master. 

----------------------------------------------------------------------

Comment By: Brian Carrier (carrier)
Date: 2011-08-15 10:37

Message:
Done for E01 files.  Not yet done for split files.  Need to change some
other ofthe logic in img_open since there are hard coded checks to use the
non-split format if only 1 image is specified.   Should probably fix in
trunk to merge raw.c and split.c.


----------------------------------------------------------------------

Comment By: Joachim Metz (jbmetz)
Date: 2011-03-04 07:25

Message:
Brian, know that libewf v2 comes with a glob functions for this, which can
be implemented in the img layer. Regarding split RAW you might want to take
a look at libsmraw (libsmio project on SF), which also has a glob function
for several split RAW naming schemes, which can be extended if necessary.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477892&aid=3197980&group_id=55685

[sleuthkit-developers] [ sleuthkit-Feature Requests-3494873 ] Better TskAuto error handling

[SourceForge.net <no...@so...>]

Feature Requests item #3494873, was opened at 2012-02-26 18:36
Message generated for change (Comment added) made by carrier
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477892&aid=3494873&group_id=55685

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: Auto
Group: None
>Status: Closed
Priority: 5
Private: No
Submitted By: Brian Carrier (carrier)
Assigned to: Nobody/Anonymous (nobody)
Summary: Better TskAuto error handling

Initial Comment:
Background: TskAuto tries to push its way through a disk image and as a result many error messages get dropped and ignored. There is a handleNotification() method now that gets some error messages, but there isn't a clear plan / policy on how someone implementing TskAuto should use it and it isn't being consistently called. We also have no way to really stop all processing if we hit some kind of really bad system error (I.e. it may stop processing a given file system, but it will then start processing then next volume).  We also blindly reset some errors right now (I.e. VsWalkCB). 

My main requirements for this system is that it is possible to stop processing entirely of an image and that all error messages can be recorded and later retrieved after the processing is done.

My proposal is:
* Add a class-level Boolean value that is set to stop all processing (ignore future volumes / file systems, etc.).
* Rename handleNotification() to registerError() and make the general requirement that when this method is called, that the TSK error values and strings will be set with an error to "register".  The implementation of TskAuto is free to keep track of these errors as it sees fit.  I was thinking about making a default version that kept a list of the errors and the error codes that could be retrieved after the processing was done.
* Document to users who implement 'processFile()' and 'processAttribute()' that they should also send their errors to registerError() so that they have a consistent reporting mechanism.
* Instruct users who implement 'processFile()' and 'processAttribute()' that they should only be returning CONT or STOP and not use the ERROR return value (or we could change the return value to only be one of those two options).  Returning ERROR implies that processFile() and such set the global error values and in this case we don't want those to be processed by the lower-level code. If processFile() encounters an error, they should record the error with registerError() and then decide to continue or stop.

Thoughts?


----------------------------------------------------------------------

>Comment By: Brian Carrier (carrier)
Date: 2012-05-03 07:53

Message:
Resolved in [master 58204fe]

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477892&aid=3494873&group_id=55685

[sleuthkit-developers] [ sleuthkit-Bugs-3523019 ] More checks on FAT "." entries

[SourceForge.net <no...@so...>]

Bugs item #3523019, was opened at 2012-05-02 06:36
Message generated for change (Comment added) made by carrier
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=3523019&group_id=55685

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: File System Tools
Group: None
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Brian Carrier (carrier)
Assigned to: Nobody/Anonymous (nobody)
Summary: More checks on FAT "." entries

Initial Comment:
Currently, TSK does special things with any "." entry it finds in the directory.  We should limit this to only the first couple of entires in the directory.  Otherwise, someone could manually change the name of a file to be "." and its content would not be accessible. 


----------------------------------------------------------------------

>Comment By: Brian Carrier (carrier)
Date: 2012-05-02 06:37

Message:
Reported by Ilias Van Peer.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=3523019&group_id=55685

[sleuthkit-developers] [ sleuthkit-Bugs-3523019 ] More checks on FAT "." entries

[SourceForge.net <no...@so...>]

Bugs item #3523019, was opened at 2012-05-02 06:36
Message generated for change (Tracker Item Submitted) made by carrier
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=3523019&group_id=55685

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: File System Tools
Group: None
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Brian Carrier (carrier)
Assigned to: Nobody/Anonymous (nobody)
Summary: More checks on FAT "." entries

Initial Comment:
Currently, TSK does special things with any "." entry it finds in the directory.  We should limit this to only the first couple of entires in the directory.  Otherwise, someone could manually change the name of a file to be "." and its content would not be accessible. 


----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=3523019&group_id=55685

[sleuthkit-developers] [ sleuthkit-Feature Requests-3519662 ] Native Extent Printing

[SourceForge.net <no...@so...>]

Feature Requests item #3519662, was opened at 2012-04-19 15:06
Message generated for change (Tracker Item Submitted) made by kfairbanks
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477892&aid=3519662&group_id=55685

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: API
Group: None
Status: Open
Priority: 5
Private: No
Submitted By: kfairbanks (kfairbanks)
Assigned to: Nobody/Anonymous (nobody)
Summary: Native Extent Printing

Initial Comment:
TSK currently prints data addresses under the notion of fixed sized blocks.  This works for systems with extents, but is not efficient.  It may be better to have a library function that prints extents for file systems that use support them.  This raises the question of how extents should be represented. 

[starting block] - [ending block],
vs
[starting block] : [run length],

This could be probably be handled in the code for each file system, but maybe a tsk_print_extents function would be bettter.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477892&aid=3519662&group_id=55685

[sleuthkit-developers] [ sleuthkit-Feature Requests-3519560 ] File system data structure checksums

[SourceForge.net <no...@so...>]

Feature Requests item #3519560, was opened at 2012-04-19 09:08
Message generated for change (Tracker Item Submitted) made by kfairbanks
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477892&aid=3519560&group_id=55685

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: API
Group: None
Status: Open
Priority: 5
Private: No
Submitted By: kfairbanks (kfairbanks)
Assigned to: Nobody/Anonymous (nobody)
Summary: File system data structure checksums

Initial Comment:
Ext4 stores checksums for various structures, I will assume other file systems do the same. It might be useful to not only have the ability to report the checksums that are stored but to recalculate them to determine whether they are valid while reporting them.  This is a little different than an fschk. This can be done just for Ext4, but maybe an API call should be added to generalize it.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=477892&aid=3519560&group_id=55685