19 Sep
2016
19 Sep
'16
9:31 a.m.
On Saturday, 17 September 2016 18:18:53 CEST Matteo Cafasso wrote:
The internal_find_block command searches all entries referring to the given filesystem data block and returns a tsk_dirent structure for each of them.
For filesystems such as NTFS which do not delete the block mapping when removing files, it is possible to get multiple non-allocated entries for the same block.
The gathered list of tsk_dirent structs is serialised into XDR format and written to a file by the appliance.
Signed-off-by: Matteo Cafasso <noxdafox@gmail.com> ---
LGTM, just one small note below.
+typedef struct { + int found;
This can be a simple bool (including <stdbool.h> to use it).
+ uint64_t block; +} findblk_data;
Thanks, -- Pino Toscano