Thread: [sleuthkit-developers] [ sleuthkit-Bugs-2856526 ] istat -b argument does nothing on HFS+ & NTFS
Brought to you by:
carrier
From: SourceForge.net <no...@so...> - 2009-09-10 23:29:55
|
Bugs item #2856526, was opened at 2009-09-10 19:29 Message generated for change (Tracker Item Submitted) made by robjoyce You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2856526&group_id=55685 Please note that this message will contain a full copy of the comment thread, including the initial issue submission, for this request, not just the latest update. Category: File System Tools Group: None Status: Open Resolution: None Priority: 5 Private: No Submitted By: Rob (robjoyce) Assigned to: Nobody/Anonymous (nobody) Summary: istat -b argument does nothing on HFS+ & NTFS Initial Comment: The -b argument to istat (limiting the number of blocks displayed) doesn't work on HFS+ and NTFS. For HFS+, I tried adding the hack of setting fs_file->meta->size in hfs_istat() befure the tsk_fs_file_walk() call -- as is done in fatfs.c and ffs.c -- but it didn't have any effect in the current trunk version. Probably because of the new attr code. But perhaps a better way to fix this, for all file systems, is to just enforce numblocks in the local print_addr_act() functions... this avoids the hack of temporarily changing the file size. The print_addr_act() void* argument can contain a field tracking the number of blocks printed. The downside is that we can't force _more_ blocks to be printed than the file has. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2856526&group_id=55685 |
From: SourceForge.net <no...@so...> - 2009-10-28 21:47:43
|
Bugs item #2856526, was opened at 2009-09-10 18:29 Message generated for change (Comment added) made by carrier You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2856526&group_id=55685 Please note that this message will contain a full copy of the comment thread, including the initial issue submission, for this request, not just the latest update. Category: File System Tools Group: None Status: Open Resolution: None Priority: 5 Private: No Submitted By: Rob (robjoyce) Assigned to: Nobody/Anonymous (nobody) Summary: istat -b argument does nothing on HFS+ & NTFS Initial Comment: The -b argument to istat (limiting the number of blocks displayed) doesn't work on HFS+ and NTFS. For HFS+, I tried adding the hack of setting fs_file->meta->size in hfs_istat() befure the tsk_fs_file_walk() call -- as is done in fatfs.c and ffs.c -- but it didn't have any effect in the current trunk version. Probably because of the new attr code. But perhaps a better way to fix this, for all file systems, is to just enforce numblocks in the local print_addr_act() functions... this avoids the hack of temporarily changing the file size. The print_addr_act() void* argument can contain a field tracking the number of blocks printed. The downside is that we can't force _more_ blocks to be printed than the file has. ---------------------------------------------------------------------- >Comment By: Brian Carrier (carrier) Date: 2009-10-28 16:07 Message: Quick comment: The original goal of the feature was to force more blocks and not limit them. Specifically it was motivated by Ext2 because it set the size to 0, but the block pointers still existed. Did you find this in the other file systems because you need this feature or because you were just playing with them and noticed that they did not work? ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2856526&group_id=55685 |
From: SourceForge.net <no...@so...> - 2009-10-29 15:58:56
|
Bugs item #2856526, was opened at 2009-09-10 19:29 Message generated for change (Comment added) made by robjoyce You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2856526&group_id=55685 Please note that this message will contain a full copy of the comment thread, including the initial issue submission, for this request, not just the latest update. Category: File System Tools Group: None Status: Open Resolution: None Priority: 5 Private: No Submitted By: Rob (robjoyce) Assigned to: Nobody/Anonymous (nobody) Summary: istat -b argument does nothing on HFS+ & NTFS Initial Comment: The -b argument to istat (limiting the number of blocks displayed) doesn't work on HFS+ and NTFS. For HFS+, I tried adding the hack of setting fs_file->meta->size in hfs_istat() befure the tsk_fs_file_walk() call -- as is done in fatfs.c and ffs.c -- but it didn't have any effect in the current trunk version. Probably because of the new attr code. But perhaps a better way to fix this, for all file systems, is to just enforce numblocks in the local print_addr_act() functions... this avoids the hack of temporarily changing the file size. The print_addr_act() void* argument can contain a field tracking the number of blocks printed. The downside is that we can't force _more_ blocks to be printed than the file has. ---------------------------------------------------------------------- >Comment By: Rob (robjoyce) Date: 2009-10-29 11:58 Message: Ah, I see. In our case, we didn't care about the block list in istat's output, so we'd do something like '-b 1'. For multi-gigabyte files, istat's normal output is 10s of megabytes (or more) long... a little awkward to deal with, especially when you're calling istat from another process. So it's not critical to us, just convenient. ---------------------------------------------------------------------- Comment By: Brian Carrier (carrier) Date: 2009-10-28 17:07 Message: Quick comment: The original goal of the feature was to force more blocks and not limit them. Specifically it was motivated by Ext2 because it set the size to 0, but the block pointers still existed. Did you find this in the other file systems because you need this feature or because you were just playing with them and noticed that they did not work? ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2856526&group_id=55685 |