Already implemented entries.
tsk_inode
tsk_type
tsk_size
tsk_name
tsk_flags
Easy ones to add.
tsk_atime_sec
tsk_atime_nsec
tsk_mtime_sec
tsk_mtime_nsec
tsk_ctime_sec
tsk_ctime_nsec
tsk_blksize
tsk_blocks
Further ideas.
tsk_nlink
tsk_link_name
Signed-off-by: Matteo Cafasso <noxdafox(a)gmail.com>
---
daemon/tsk.c | 4 +++-
generator/structs.ml | 6 ++++++
tests/tsk/test-filesystem-walk.sh | 16 ++++++++++++++--
3 files changed, 23 insertions(+), 3 deletions(-)
diff --git a/daemon/tsk.c b/daemon/tsk.c
index 65159ad..446213e 100644
--- a/daemon/tsk.c
+++ b/daemon/tsk.c
@@ -128,7 +128,9 @@ fswalk_callback (TSK_FS_FILE *fsfile, const char *path, void *data)
dirent.tsk_name = fname;
dirent.tsk_flags = file_flags (fsfile);
dirent.tsk_spare1 = dirent.tsk_spare2 = dirent.tsk_spare3 =
- dirent.tsk_spare4 = dirent.tsk_spare5 = 0;
+ dirent.tsk_spare4 = dirent.tsk_spare5 = dirent.tsk_spare6 =
+ dirent.tsk_spare7 = dirent.tsk_spare8 = dirent.tsk_spare9 =
+ dirent.tsk_spare10 = dirent.tsk_spare11 = 0;
ret = send_dirent_info (&dirent);
ret = (ret == 0) ? TSK_WALK_CONT : TSK_WALK_ERROR;
diff --git a/generator/structs.ml b/generator/structs.ml
index acc0661..eb8931f 100644
--- a/generator/structs.ml
+++ b/generator/structs.ml
@@ -459,6 +459,12 @@ let structs = [
"tsk_spare3", FInt64;
"tsk_spare4", FInt64;
"tsk_spare5", FInt64;
+ "tsk_spare6", FInt64;
+ "tsk_spare7", FInt64;
+ "tsk_spare8", FInt64;
+ "tsk_spare9", FInt64;
+ "tsk_spare10", FInt64;
+ "tsk_spare11", FInt64;
];
s_camel_name = "TSKDirent" };
diff --git a/tests/tsk/test-filesystem-walk.sh b/tests/tsk/test-filesystem-walk.sh
index c816267..6ee3f71 100755
--- a/tests/tsk/test-filesystem-walk.sh
+++ b/tests/tsk/test-filesystem-walk.sh
@@ -55,7 +55,13 @@ tsk_spare1: 0
tsk_spare2: 0
tsk_spare3: 0
tsk_spare4: 0
-tsk_spare5: 0 }'
+tsk_spare5: 0
+tsk_spare6: 0
+tsk_spare7: 0
+tsk_spare8: 0
+tsk_spare9: 0
+tsk_spare10: 0
+tsk_spare11: 0 }'
if [ $? != 0 ]; then
echo "$0: \$MFT not found in files list."
echo "File list:"
@@ -73,7 +79,13 @@ tsk_spare1: 0
tsk_spare2: 0
tsk_spare3: 0
tsk_spare4: 0
-tsk_spare5: 0 }'
+tsk_spare5: 0
+tsk_spare6: 0
+tsk_spare7: 0
+tsk_spare8: 0
+tsk_spare9: 0
+tsk_spare10: 0
+tsk_spare11: 0 }'
if [ $? != 0 ]; then
echo "$0: /test.txt not found in files list."
echo "File list:"
--
2.8.1