Signed-off-by: Matteo Cafasso <noxdafox@gmail.com> --- daemon/tsk.c | 27 +++++++++++++++++++++++++++ generator/actions.ml | 19 +++++++++++++++++++ src/MAX_PROC_NR | 2 +- 3 files changed, 47 insertions(+), 1 deletion(-) diff --git a/daemon/tsk.c b/daemon/tsk.c index 5b55739..a00f3ee 100644 --- a/daemon/tsk.c +++ b/daemon/tsk.c @@ -86,6 +86,33 @@ do_blkcat (const mountable_t *mountable, int64_t start, int64_t number) return file_out (cmd); } +int +do_blkls (const mountable_t *mountable, int64_t start, int64_t stop) +{ + CLEANUP_FREE char *cmd = NULL; + + /* Data unit address start must be greater than 0 */ + if (start < 0) { + reply_with_error ("data unit starting address must be >= 0"); + return -1; + } + + /* Data unit address end must be greater than start */ + if (stop <= start) { + reply_with_error ("data unit stopping address must be > starting one"); + return -1; + } + + /* Construct the command. */ + if (asprintf (&cmd, "blkls %s %" PRIi64 "-%" PRIi64, + mountable->device, start, stop) == -1) { + reply_with_perror ("asprintf"); + return -1; + } + + return file_out (cmd); +} + static int file_out (const char *cmd) { diff --git a/generator/actions.ml b/generator/actions.ml index 0fabed6..8ecdace 100644 --- a/generator/actions.ml +++ b/generator/actions.ml @@ -12976,6 +12976,25 @@ while on ExtX ones they are referred as fragments. This command allows to download unallocated sectors of the disk." }; + { defaults with + name = "blkls"; added = (1, 33, 14); + style = RErr, [Mountable "device"; Int64 "start"; Int64 "stop"; FileOut "filename"], []; + proc_nr = Some 466; + optional = Some "sleuthkit"; + progress = true; cancellable = true; + shortdesc = "download the unallocated data units from the disk"; + longdesc = "\ +Download the unallocated data units from F<start> address +to F<stop> from the disk partition (eg. F</dev/sda1>) +and save them as F<filename> on the local machine. + +The use of this API on sparse disk image formats might results +in long zero-filled strings downloaded on the host. + +The size of a data unit varies across filesystem implementations. +On NTFS filesystems data units are referred as clusters +while on ExtX ones they are referred as fragments." }; + ] (* Non-API meta-commands available only in guestfish. diff --git a/src/MAX_PROC_NR b/src/MAX_PROC_NR index 073c57b..f27d46f 100644 --- a/src/MAX_PROC_NR +++ b/src/MAX_PROC_NR @@ -1 +1 @@ -465 +466 -- 2.7.0