[ sleuthkit-Bugs-2856526 ] istat -b argument does nothing on HFS+ & NTFS

[SourceForge.net]

Bugs item #2856526, was opened at 2009-09-10 18:29
Message generated for change (Comment added) made by carrier
You can respond by visiting:
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2856526&group_id=55685

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: File System Tools
Group: None
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Rob (robjoyce)
Assigned to: Nobody/Anonymous (nobody)
Summary: istat -b argument does nothing on HFS+ & NTFS

Initial Comment:
The -b argument to istat (limiting the number of blocks displayed) doesn't work on HFS+ and NTFS.  For HFS+, I tried adding the hack of setting fs_file->meta->size in hfs_istat() befure the tsk_fs_file_walk() call -- as is done in fatfs.c and ffs.c -- but it didn't have any effect in the current trunk version.   Probably because of the new attr code.

But perhaps a better way to fix this, for all file systems, is to just enforce numblocks in the local print_addr_act() functions... this avoids the hack of temporarily changing the file size.  The print_addr_act() void* argument can contain a field tracking the number of blocks printed.  The downside is that we can't force _more_ blocks to be printed than the file has.

----------------------------------------------------------------------

>Comment By: Brian Carrier (carrier)
Date: 2009-10-28 16:07

Message:
Quick comment: The original goal of the feature was to force more blocks
and not limit them.  Specifically it was motivated by Ext2 because it set
the size to 0, but the block pointers still existed.

Did you find this in the other file systems because you need this feature
or because you were just playing with them and noticed that they did not
work?

----------------------------------------------------------------------

You can respond by visiting:
https://sourceforge.net/tracker/?func=detail&atid=477889&aid=2856526&group_id=55685

------------------------------------------------------------------------------
Come build with us! The BlackBerry(R) Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and stay
ahead of the curve. Join us from November 9 - 12, 2009. Register now!
http://p.sf.net/sfu/devconference
_______________________________________________
sleuthkit-developers mailing list
sleuthkit-developers@...
https://lists.sourceforge.net/lists/listinfo/sleuthkit-developers