Signed-off-by: Matteo Cafasso <noxdafox(a)gmail.com>
---
daemon/tsk.c | 27 +++++++++++++++++++++++++++
generator/actions.ml | 19 +++++++++++++++++++
src/MAX_PROC_NR | 2 +-
3 files changed, 47 insertions(+), 1 deletion(-)
diff --git a/daemon/tsk.c b/daemon/tsk.c
index 5b55739..a00f3ee 100644
--- a/daemon/tsk.c
+++ b/daemon/tsk.c
@@ -86,6 +86,33 @@ do_blkcat (const mountable_t *mountable, int64_t start, int64_t
number)
return file_out (cmd);
}
+int
+do_blkls (const mountable_t *mountable, int64_t start, int64_t stop)
+{
+ CLEANUP_FREE char *cmd = NULL;
+
+ /* Data unit address start must be greater than 0 */
+ if (start < 0) {
+ reply_with_error ("data unit starting address must be >= 0");
+ return -1;
+ }
+
+ /* Data unit address end must be greater than start */
+ if (stop <= start) {
+ reply_with_error ("data unit stopping address must be > starting one");
+ return -1;
+ }
+
+ /* Construct the command. */
+ if (asprintf (&cmd, "blkls %s %" PRIi64 "-%" PRIi64,
+ mountable->device, start, stop) == -1) {
+ reply_with_perror ("asprintf");
+ return -1;
+ }
+
+ return file_out (cmd);
+}
+
static int
file_out (const char *cmd)
{
diff --git a/generator/actions.ml b/generator/actions.ml
index 0fabed6..8ecdace 100644
--- a/generator/actions.ml
+++ b/generator/actions.ml
@@ -12976,6 +12976,25 @@ while on ExtX ones they are referred as fragments.
This command allows to download unallocated sectors of the disk." };
+ { defaults with
+ name = "blkls"; added = (1, 33, 14);
+ style = RErr, [Mountable "device"; Int64 "start"; Int64
"stop"; FileOut "filename"], [];
+ proc_nr = Some 466;
+ optional = Some "sleuthkit";
+ progress = true; cancellable = true;
+ shortdesc = "download the unallocated data units from the disk";
+ longdesc = "\
+Download the unallocated data units from F<start> address
+to F<stop> from the disk partition (eg. F</dev/sda1>)
+and save them as F<filename> on the local machine.
+
+The use of this API on sparse disk image formats might results
+in long zero-filled strings downloaded on the host.
+
+The size of a data unit varies across filesystem implementations.
+On NTFS filesystems data units are referred as clusters
+while on ExtX ones they are referred as fragments." };
+
]
(* Non-API meta-commands available only in guestfish.
diff --git a/src/MAX_PROC_NR b/src/MAX_PROC_NR
index 073c57b..f27d46f 100644
--- a/src/MAX_PROC_NR
+++ b/src/MAX_PROC_NR
@@ -1 +1 @@
-465
+466
--
2.7.0