Commit Graph

9 Commits

Author SHA1 Message Date
Matteo Cafasso
79fdc9ad47 find_inode: added API tests
NTFS file system always has the MFT file at inode 0. This reliable
information helps testing the API.

Signed-off-by: Matteo Cafasso <noxdafox@gmail.com>
2016-09-19 19:53:07 +02:00
Matteo Cafasso
a77c6aac81 Added download_blocks API test
The test shows how the function can be used to retrieve deleted data
from a disk partition.

Signed-off-by: Matteo Cafasso <noxdafox@gmail.com>
2016-07-20 15:26:50 +02:00
Matteo Cafasso
abf85b050e filesystem_walk: more information into tsk_dirent
Access, modification, last status change and creation time in
Unix format as for statns.

Number of links pointing to a given entry.

If the entry is a symbolic link, report the its target path.

A new flag (DIRENT_COMPRESSED 0x04) indicating whether the file is
compressed using native filesystem compression support.

Signed-off-by: Matteo Cafasso <noxdafox@gmail.com>
2016-07-08 12:08:17 +02:00
Matteo Cafasso
2d65129e7e Reserve entries to tsk_dirent struct
Already implemented entries.

tsk_inode
tsk_type
tsk_size
tsk_name
tsk_flags

Easy ones to add.

tsk_atime_sec
tsk_atime_nsec
tsk_mtime_sec
tsk_mtime_nsec
tsk_ctime_sec
tsk_ctime_nsec
tsk_blksize
tsk_blocks

Further ideas.

tsk_nlink
tsk_link_name

Signed-off-by: Matteo Cafasso <noxdafox@gmail.com>
2016-06-28 22:09:36 +01:00
Matteo Cafasso
7d8fbde4b2 lib: Added filesystem_walk command tests
The tests check whether the filesystem_walk command is able to retrieve
information regarding both existing and deleted files.

A NTFS image is used as Ext3+ filesystems deletion is more aggressive
in terms of metadata removal.

Signed-off-by: Matteo Cafasso <noxdafox@gmail.com>
2016-06-22 18:43:51 +01:00
Pino Toscano
64bb9edd52 tests: specify the image format when possible
When possible, make the disk image format explicit when invoking tools
or using add-drive. This avoids warnings from qemu about the unspecified
format for the image, and also makes qemu slightly faster (skipping the
disk image probing).
Tests checking the image probing are not touched.

This changes also:
- old-style invocations of tools (`$tool $filename`) into new style
  (`$tool -a $filename`)
- add-drive-ro/add-drive-with-if guestfish commands into add/add-drive
  with explicit readonly/iface arguments

There should be no change in the tests results.
2016-05-19 19:06:00 +02:00
Matteo Cafasso
5fd0819ebc Rename icat command in download_inode
The "icat" name comes from the employed command line tool which might be
replaced at any time with a different implementation.

The command name is a bit confusing because it's similar to "cat" but
act as "download".

download_inode is more clear and descriptive.

Signed-off-by: Matteo Cafasso <noxdafox@gmail.com>
2016-03-31 10:50:42 +02:00
Matteo Cafasso
d314d10e1f sleuthkit availability check renamed
>From 'available icat' to 'available sleuthkit'.

Signed-off-by: Matteo Cafasso <noxdafox@gmail.com>
2016-03-08 21:13:10 +00:00
Matteo Cafasso
ac0d2adf56 added icat API tests
Signed-off-by: Matteo Cafasso <noxdafox@gmail.com>
2016-03-07 19:33:53 +00:00