On Saturday, 17 September 2016 18:18:53 CEST Matteo Cafasso wrote:
The internal_find_block command searches all entries referring to
the
given filesystem data block and returns a tsk_dirent structure
for each of them.
For filesystems such as NTFS which do not delete the block mapping
when removing files, it is possible to get multiple non-allocated
entries for the same block.
The gathered list of tsk_dirent structs is serialised into XDR format
and written to a file by the appliance.
Signed-off-by: Matteo Cafasso <noxdafox(a)gmail.com>
---
LGTM, just one small note below.
+typedef struct {
+ int found;
This can be a simple bool (including <stdbool.h> to use it).
+ uint64_t block;
+} findblk_data;
Thanks,
--
Pino Toscano