Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
Newer
Older
100644 1785 lines (1330 sloc) 73.511 kb
5668cd9 @bcarrier Updated NEWS.txt file with missing entries and changed format
bcarrier authored
1 Numbers refer to SourceForge.net tracker IDs:
2 http://sourceforge.net/tracker/?group_id=55685
1b20a34 @bcarrier fix for 2645156 that caused some FAT file slack to be missing in dls …
bcarrier authored
3
e8b3381 @bcarrier Merging in C++ classes and multithreaded support
bcarrier authored
4
5 ---------------- VERSION 3.3.0 --------------
6 New Features:
7 - Added multithreaded support
8 - Added C++ wrapper classes
1d39876 @bcarrier initial version of jni / data model -- code by Anthony Lawrence
bcarrier authored
9 - Added JNI bindings / Java data model classes
dea26db @bcarrier 3314047: re utf8 specific versions of img/vs/fs toid versions
bcarrier authored
10 - 3314047: Added utf8-specific versions of 'toid' methods for img,vs,fs types
b241e50 @bcarrier 3316603: RAW CD Last blocks
bcarrier authored
11 - 3184429: More consistent printing of unset times (all zerso instead of 1970)
334ca3d @bcarrier New database design that supports multiple images. Patch by Peter Ma…
bcarrier authored
12 - New database design that allows for multiple images in the same database
0014a3b @bcarrier GPT tries other sector sizes if img provided size fails
bcarrier authored
13 - GPT volume system tries other sector sizes if first attempt fails.
183b897 @bcarrier Added JNI support / datamodel support for hash lookups. Patch by Pet…
bcarrier authored
14 - Added hash calculation and lookup to AutoDB and JNI.
7200d9d @bcarrier Upgraded SQLIte to 3.7.9
bcarrier authored
15 - Upgraded SQLite to 3.7.9.
e8c1018 @bcarrier Added first release of framework
bcarrier authored
16 - Added Framework in (windows-only)
c922a88 @bcarrier Updated NEWS for encase hash set
bcarrier authored
17 - EnCase hash support
7dcf786 @bcarrier Added libewf v2 API support based on patch in issue 3367368 from ocho…
bcarrier authored
18 - Libewf v2 support (it is now non-beta)
e8b3381 @bcarrier Merging in C++ classes and multithreaded support
bcarrier authored
19
d199bab @bcarrier Relaxed GPT vs DOS resolution rules
bcarrier authored
20 Bug Fixes:
21 - Relaxed checking when conflict exists between DOS and GPT partitions.
22 Had a Mac image that was failing to resolve which partition table
ed883bb @bcarrier test update to NEWS.txt
bcarrier authored
23 to use.
d199bab @bcarrier Relaxed GPT vs DOS resolution rules
bcarrier authored
24
73d2aaa @bcarrier Added verbose statement to tskAuto go get error messages
bcarrier authored
25 ---------------- VERSION 3.2.3 --------------
26 New Features:
27 - new TskAuto method (handleNotification()) that gets verbose messages that allow for debugging when the class makes decisions.
c01074b @bcarrier Allow for corrupt DOS extended partitions
bcarrier authored
28 - DOS partitions are loaded even if an extended partition fails to load
a8dc242 @bcarrier new TskAuto::findFilesInFs(TSK_FS_INFO *) method from Eamonn Saunders
bcarrier authored
29 - new TskAuto::findFilesInFs(TSK_FS_INFO *) method
98dca68 @bcarrier Only first image in E01 set needs to be specified
bcarrier authored
30 - Need to only specify first E01 file and the rest are found
7d92742 @bcarrier fix for 3405265 re: API docs license
bcarrier authored
31 - Changed docs license to non-commercial
da9101d @bcarrier minor update on unicode cleanup
bcarrier authored
32 - Unicode conversion routines fix invalid UTF-16 text during conversion
a9a6344 @bcarrier Added -d option to tsk_recover
bcarrier authored
33 - Added '-d' to tsk_recover to specify directory to recover
98dca68 @bcarrier Only first image in E01 set needs to be specified
bcarrier authored
34
73d2aaa @bcarrier Added verbose statement to tskAuto go get error messages
bcarrier authored
35
b5f3519 @bcarrier added more checks if backup FAT boot sector is used during open
bcarrier authored
36 Bug Fixes:
37 - Added check to fatfs_open to compare first sectors of FAT if we used backup boot sector and verify it is FAT32.
b477838 @bcarrier merged fixes from branch that deal with cleaning up short FAT name
bcarrier authored
38 - More checks to make sure that FAT short names are valid ASCII
6c7bcca @bcarrier Fix for 3406523 re: mactime sanity check on size from Joachim Metz
bcarrier authored
39 - 3406523: Mactime size sanity check
69a4a43 @bcarrier fix for 3393960 re: hfind processing of Windows input files
bcarrier authored
40 - 3393960: hfind reading of Windows input file
b241e50 @bcarrier 3316603: RAW CD Last blocks
bcarrier authored
41 - 3316603: Error reading last blocks of RAW CD images
8dbe7f1 @bcarrier fixed bugs with isDir/isFile in TskAuto
bcarrier authored
42 - Fixed bugs in how directories and files were detected in TskAuto
b241e50 @bcarrier 3316603: RAW CD Last blocks
bcarrier authored
43
b5f3519 @bcarrier added more checks if backup FAT boot sector is used during open
bcarrier authored
44
73d2aaa @bcarrier Added verbose statement to tskAuto go get error messages
bcarrier authored
45
5d53e05 @bcarrier resolved issues 3213886 and 3213888 re: RAW CD and not handling ISO96…
bcarrier authored
46 ---------------- VERSION 3.2.2 --------------
47 Bug Fixes
48 - 3213886: ISO9660 directory hole not advancing
bfd59e2 @bcarrier Added IMG_INFO openImage method to auto class
bcarrier authored
49 - 3173095 contd: Updated checks so that tougher FAT checks are
50 applied to deleted directories.
60cd536 @bcarrier resolved issue 3303679 re: deleted short FAT names with invalid UTF-…
bcarrier authored
51 - 3303678: Image type in Sqlite DB is now not always 0
52 - 3303679: Deleted FAT files have more name cleanup in short names
5d53e05 @bcarrier resolved issues 3213886 and 3213888 re: RAW CD and not handling ISO96…
bcarrier authored
53
54 New Features:
55 - 3213888: RAW CD format
bfd59e2 @bcarrier Added IMG_INFO openImage method to auto class
bcarrier authored
56 - Auto class accepts TSK_IMG_INFO as argument
bb012b7 @bcarrier split image names are stored in local copy
bcarrier authored
57 - Copies of split image file names are stored in TSK so that the caller can free them before TSK_IMG_INFO is freed.
5d53e05 @bcarrier resolved issues 3213886 and 3213888 re: RAW CD and not handling ISO96…
bcarrier authored
58
2cb22de @bcarrier fixed issue 3108272 regarding fls flags.
bcarrier authored
59 ---------------- VERSION 3.2.1 --------------
60 Bug Fixes
61 - 3108272: fls arguments for -d and -u
5855a5e @bcarrier 3105539: sqlite compile issues because pthread and ldl were needed
bcarrier authored
62 - 3105539: compile error issues because of SQlite and pthreads
05b721c @bcarrier resolved 3173095 re: files with invalid FAT dates now being shown
bcarrier authored
63 - 3173095: missing FAT files because of invalid dates.
0f13e76 @bcarrier part of issue 3184419 re: mingw compile errors
bcarrier authored
64 - 3184419: mingew compile errors.
330c409 @bcarrier issue 3191391 re: quotes in mactime csv output
bcarrier authored
65 - 3191391: surround file name in quotes in mactime -d csv output
6ea685c @bcarrier fix for 3043092 re: minor ifind logic issues
bcarrier authored
66
d530bcc @bcarrier added dummy entries to sqlite db if there is no volume system
bcarrier authored
67 New Features:
68 - A single dummy entry is added to the SQlite DB if no volume exists
69 so that all programs can assume that there will be at least one
70 volume in the table.
b6640d8 @bcarrier 3184455 re: builddir != srcdir
bcarrier authored
71 - 3184455: allow srcdir != builddir
d530bcc @bcarrier added dummy entries to sqlite db if there is no volume system
bcarrier authored
72
6ea685c @bcarrier fix for 3043092 re: minor ifind logic issues
bcarrier authored
73 ---------------- VERSION 3.2.0 --------------
74 Bug Fixes
75 - 3043092: Minor logic errors with ifind code.
7447626 @bcarrier minor bug fix in tsk_recover for file names in Unix
bcarrier authored
76 - FAT performance fix when looking for parent directories
77 in $OrphanFiles.
7eaa38c @bcarrier fixed issue 3052302 re: tsk_malloc trying to do a memset on data that…
bcarrier authored
78 - 3052302: Crash on NTFS/UFS detection test because of
79 corrupt data -- tsk_malloc error.
41e8227 @bcarrier patch for issue 3088447 regarding duplicate NTFS IDs
bcarrier authored
80 - 3088447: Error adding attribute because of run collision.
81 Solved by assigning unique IDs.
6ea685c @bcarrier fix for 3043092 re: minor ifind logic issues
bcarrier authored
82
9b5ee21 @bcarrier fix for 3012324 re: moving name mangling to outer layers and not in f…
bcarrier authored
83 New Features:
84 - 3012324: Name mangling moved out of library into outer tools
ad286b1 @bcarrier patch for 2993806 re: NONE value for ENUMs. Patch by Anthony Lawrence
bcarrier authored
85 so that they can see control characters if they want to. Patch
86 by Anthony Lawrence.
87 - 2993806: ENUM values have a specified NONE value if you don't
88 want to specify any special flags. Patch by Anthony Lawrence.
1036530 @bcarrier patch for 3026989 re: -e and -s flags to img_cat
bcarrier authored
89 - 3026989: Add -e and -s flags to img_cat. patch by Simson Garfinkel.
e24a2b6 @bcarrier patch 2941805 re: HFS case sensitive data by Rob Joyce.
bcarrier authored
90 - 2941805: Add case sensitive flag to fsstat in HFS. Patch by Rob Joyce.
a605ad0 @bcarrier patch for 3017764 re: not giving a fake name to NTFS attributes.
bcarrier authored
91 - 3017764: Changed how default NTFS $DATA attribute was named. Now it
92 has no name, while it previously had a fake name of "$Data".
41e8227 @bcarrier patch for issue 3088447 regarding duplicate NTFS IDs
bcarrier authored
93 - New TskAuto class.
94 - New tsk_loaddb, tsk_recover, tsk_comparedir, and tsk_gettimes tools.
9b5ee21 @bcarrier fix for 3012324 re: moving name mangling to outer layers and not in f…
bcarrier authored
95
1170040 @bcarrier resolved issue 3006733 re: slow directory listings because fs_dir_wal…
bcarrier authored
96 ---------------- VERSION 3.1.3 --------------
97 Bug Fixes
98 - 3006733: FAT directory listings were slow because the inner
99 code was not stopping when it found the parent directory.
044bb48 @bcarrier fixed fat checking errors in file name entries
bcarrier authored
100 - Adjusted sanity / testing code on FAT directory entries to allow
101 non-ascii in extensions and reject entries with lots of 0s.
7dad1e1 @bcarrier resolved issue 3023606 re: corrupt ext2 name
bcarrier authored
102 - 3023606: Ext2 / ffs corrupted file names.
57a0f78 @bcarrier applied NTFS SID patches from Mandiant
bcarrier authored
103 - Applied NTFS SID fixes from Mandiant.
4c3ffc8 @bcarrier applied ntfs_load_secure() memory leak from Michael Cohen.
bcarrier authored
104 - ntfs_load_secure() memory leak patch from Michael Cohen
1170040 @bcarrier resolved issue 3006733 re: slow directory listings because fs_dir_wal…
bcarrier authored
105
198bdd8 @bcarrier resolved issue 2982426 by not scanning entire image in search of pare…
bcarrier authored
106 ---------------- VERSION 3.1.2 --------------
107 Bug Fixes
108 - 2982426: FAT directory listings were slow because the entire
109 image was being scanned for parent directory information.
12d0417 @bcarrier applied patch 2982965 to fix attribute length values
bcarrier authored
110 - 2982965: fs_attr length bug fix.
9d09230 @bcarrier fixed issue 2988619 re: mmls -B display errors
bcarrier authored
111 - 2988619: mmls -B display error.
451e395 @bcarrier applied patch from 2988330 for NTFS SII processing
bcarrier authored
112 - 2988330: ntfs SII cluster size increment bug
5cac172 @bcarrier fixed issue 2991487 re: zeroed content in NTFS files that are not ful…
bcarrier authored
113 - 2991487: Zeroed content in NTFS files that were not fully intialized.
20ebf23 @bcarrier fix for 2993767 re: slow FAT directory listings because orphan files …
bcarrier authored
114 - 2993767: Slow FAT listings of OrphanFiles because hunt for parent
115 directory resulted in many searches for OrphanFiles. Added cache
116 of OrphanFiles.
92cb8e4 @bcarrier resolved issue 2999567 re: ifind not stopping after first hit
bcarrier authored
117 - 2999567: ifind was not stopping after first hit.
68dad51 @bcarrier resolved issue 2993804 re: not returning -1 on some reads past end of…
bcarrier authored
118 - 2993804: read past end of file did not always return -1.
198bdd8 @bcarrier resolved issue 2982426 by not scanning entire image in search of pare…
bcarrier authored
119
27e8fb2 @bcarrier fixed issue 2954703 re: missing file in ISO9660
bcarrier authored
120 ---------------- VERSION 3.1.1 --------------
121
122 Bug Fixes
123 - 2954703: ISO9660 missing files because duplicate files
124 had same starting block.
15acd4f @bcarrier forgot this in the previous update
bcarrier authored
125 - 2954707: ISO9660 missing some files with zero length and
126 duplicate starting block. Also changed behavior of how
127 multiple volume descriptors are processed.
f17c950 @bcarrier resolved issue 2955898 re: missing orphan files if no deleted file na…
bcarrier authored
128 - 2955898: Orphan files not found if no deleted file names exist.
8bd7e62 @bcarrier resolved issue 2955899 re: NTFS setting of USED flag.
bcarrier authored
129 - 2955899: NTFS internal setting of USED flag.
e536877 @bcarrier resolved issue 2972721 re: sorter not cleaning up MD5sum output that …
bcarrier authored
130 - 2972721: Sorter fails with hash lookup if '-l' is given.
c3adb4a @bcarrier resolved issue 2941813 re: incorrect internal HFS case sensitive flags
bcarrier authored
131 - 2941813: Reverse HFS case sensitive flags (internal fix only)
af60d07 @bcarrier fixed 2954448 re: Debian package typos and flags
bcarrier authored
132 - 2954448: Debian package typo fixes, etc.
951c215 @bcarrier resolved issue 2975245 re: sorter and realloc entries
bcarrier authored
133 - 2975245: sorter ignores realloc entries to reduce misleading mismatch entries and duplicate entries.
27e8fb2 @bcarrier fixed issue 2954703 re: missing file in ISO9660
bcarrier authored
134
135
5668cd9 @bcarrier Updated NEWS.txt file with missing entries and changed format
bcarrier authored
136 ---------------- VERSION 3.1.0 --------------
7956fd3 @bcarrier Applied patch from 2857258 for HFS flags
bcarrier authored
137
5668cd9 @bcarrier Updated NEWS.txt file with missing entries and changed format
bcarrier authored
138 New Features and Changes
139 - 2206285: HFS+ can now be read. Lots of tracker items about this.
140 Thanks to Rob Joyce and ATC-NY for many of the patches and reports.
141 - 2677069: DOS Safety Partitions in GPT Volume Systems are better
142 detected instead of reporting multiple VSs.
143 - Windows executables can be build in Visual Studio w/out needing
144 other image format libraries.
145 - 2367426: Uninitialized file space is shown if slack space is
146 requested.
147 - 2677107 All image formats supported by AFFLIB can be accessed by
148 specifying the "afflib" type.
149 - 2206265: sigfind can now process non-raw files.
150 - 2206331: Indirect block addresses are now available in the library
151 and command line tools. They are stored in a different attribute.
152 - Removed 'docs' files and moved them to the wiki.
153 - Removed disk_stat and disk_sreset because they were out of date
154 and hdparm now has the same functionality.
155 - 2874854: Image layer tools now support non-512 byte device sector
156 sizes. Users can specify sector size using the -b argument to the
157 command line tools. This has several consequences:
158 -- 'mmls -b' is now 'mmls -B'. Similarly with istat -b.
159 -- Changed command line format for '-o' so that sector size is
160 specified only via -b and not using '-o 62@4096'.
161 - 2874852: Sanity checking on partition table entires is relaxed
162 and only first couple of partitions are checked to make sure that
163 they can fit into the image.
164 - 2895607: NTFS SID data is available in the library and 'istat'.
165 - 2206341: AFF encrypted images now give more proper error message
166 if password is not given.
167 - 2351426: mactime is now distributed with Windows execs.
168
169
170 Developer-level Changes
171 - Abstracted name comparison to file system-specific function.
172 - Added support in mactime to read body files with comment lines.
173 - 2596153: Changed img_open arguments, similar to getopt().
174 - 2797169: tsk_fs_make_ls is now supported as an external library
175 function. Now named tsk_fs_meta_make_ls.
176 - 2908510: Nanosecond resolution of timestamps is now available.
177 - 2914255: Version info is now available in .h files in both string
178 and integer form.
179
180 Bug Fixes:
181 - 2568528: incorrect adjustment of attribute FILLER offset.
182 - 2596397: Incorrect date sorting in mactime.
183 - 2708195: Errors when doing long reads in fragmented attributes.
184 - Fixed typo bugs in sorter (reported via e-mail by Drew Hunt).
185 - 2734458: added orphan cache map to prevent slow NTFS listing times.
186 - 2655831: Sorter now knows about the ext2 and ext3 types.
187 - 2725799: ifind not converting UTF16 names properly on Windows
188 because it was using endian ordering of file system and not local
189 system.
190 - 2662168: warning messages on macs when reading the raw character
191 device.
192 - 2778170: incorrect read size on resident attributes.
193 - 2777633: missing second resolution on FAT creation times.
194 - Added the READ_SHARE option to the CreateFile command for split
195 image files. Patch by Christopher Siwy.
196 - 2786963: NTFS compression infinite loop fix.
197 - 2645156: FAT / blkls error getting slack because allocsize was
198 being set too small (and other values were not being reset).
199 - 2367426: Zeros are set for VDL slack on NTFS files.
200 - 2796945: Inifite loop in fs_attr.
201 - 2821031: Missing fls -m fields.
202 - 2840345: Extended DOS partitions in extended partitions are now
203 marked as Meta.
204 - 2848162: Reading attributes at offsets that are on boundary of
205 run fragment.
206 - 2824457: Fixed issue reading last block of file system with blkcat.
207 - 2891285: Fixed issue that prevented reads from the last block of
208 a file system when using the POSIX-style API.
209 - 2825690: Fixed issue that prevented blkls -A from working.
210 - 2901365: Allow FAT files to have a 0 wdate.
211 - 2900761: Added FAT directory sanity checks to prevent infinite loops.
212 - 2895607: Fixed various memory leaks.
213 - 2907248: Fixed image layer cache crash.
214 - 2905750: all file system read() functions now return -1 when
215 offset given is past end of file.
a30ae04 @bcarrier Addressed issue 2901365 re: missing FAT files by allowing wdate to be 0
bcarrier authored
216
64ba054 @bcarrier applied recurisve sanity checks for parent directory finding (issue 2…
bcarrier authored
217
4e466f1 @bcarrier Arranged CHANGES file to include 3.0.1 release
bcarrier authored
218 ---------------- VERSION 3.0.1 --------------
219 11/11/08: Bug Fix: Fixed crashing bug in ifind on FAT file system.
220 Bug: 2265927
221
222 11/11/08: Bug Fix: Fixed crashing bug in istat on ExtX $OrphanFiles
223 dir. Bug: 2266104
224
225 11/26/08: Update: Updated fls man page.
226
227 11/30/08: Update: Removed TODO file and using tracker for bugs and
228 feature requests.
229
230 12/29/08: Bug Fix: Fixed incorrectly setting block status in file_walk
231 for compressed files (Bug: 2475246)
232
233 12/29/08: Bug Fix: removed fs_info field from FS_META because it
234 was not being set and should have been removed in 3.0. Reported by
235 Rob Joyce and Judson Powers.
236
237 12/29/08: Bug Fix: orphan files and NTFS files found via parent
238 directory have an unknown file name type (instead of being equal
239 to meta type). (Bug: 2389901). Reported by Barry Grundy.
240
241 1/12/09: Bug Fix: Fixed ISO9660 bug where large directory contents
242 were not displayed. (Bug: 2503552). Reported by Tom Black.
243
244 1/24/09: Bug Fix: Fixed bug 2534449 where extra NTFS files were
245 shown if the MFT address was changed to 0 because fs_dir_add was
246 checking the address and name. Reported by Andy Bontoft.
247
248 1/29/09: Update: Fixed fix for bug 2534449. The fix is in ifind
249 instead of fs_dir_add().
250
251 2/2/09: Update: Added RPM spec file from Morgan Weetmam.
252
253
5d365e3 @bcarrier Removed fs_info from FS_META
bcarrier authored
254 ---------------- VERSION 3.0.0 --------------
3a78df5 @bcarrier initial import from CVS
bcarrier authored
255 0/00/00: Update: Many, many, many API changes.
256
257 2/14/08: Update: Added mmcat tool.
258
259 2/26/08: Update: Added flags to mmls to specify partition types.
260
261 3/1/08: Update: Major update of man pages.
262
263 4/14/08: Bug Fix: Fixed the calculation of "actual" last block.
264 Off by 1 error. Reported by steve.
265
266 5/23/08: Bug Fix: Incorrect malloc return check in srch_strings.
267 reported by Petri Latvala.
268
269 5/29/08: Bug Fix: Fixed endian ordering bug in ISO9660 code. Reported
270 by Eduardo Aguiar de Oliveira.
271
272 6/17/08: Update: 'sorter' now uses the ifind method for finding
273 deleted NTFS files (like Autopsy) does instead of relying on fls.
274 Reported by John Lehr.
275
276 6/17/08: Update: 'ifind -p' reports data on ADS.
277
278 7/10/08: Update: FAT looks for a backup boot sector in FAT32 if
279 magic is 0
280
281 7/21/08: Bug Fix: Changed define of strcasecmp to _stricmp instead
282 of _strnicmp in Windows. (reported by Darren Bilby).
283
284 7/21/08: Bug Fix: Fall back to open "\\.\" image files on Windows
285 with SHARE_WRITE access so that drive devices can be opened.
286 (reported by Darren Bilby).
287
288 8/20/08: Bug Fix: Look for Windows objects when opening files in
289 Cygwin, not just Win32. Reported by Par Osterberg Medina.
290
291 8/21/08: Update: Renamed library and install header files to have a '3'
292 in them to allow parallel installations of v2 and v3. Suggested by
293 Simson Garfinkel.
294
295 8/22/08: Update: Added -b option to sorter to specify minimum file size
296 to process. Suggested by Jeff Kell.
297
298 8/22/08: Update: Added libewf as a requirement to build win32 so that
299 E01 files are supported.
300
301 8/29/08: Update: Added initial mingw patches for cross compiling and
302 Windows. Patches by Michael Cohen.
303
304 9/X/08: Update: Added ability to access attibutes
305
306 9/6/08: Update: Added image layer cache.
307
308 9/12/08: Bug Fix: Fixed crash from incorrectly cleared value in FS_DIR
309 structure. Reported and patched by Jason Miller.
310
311 9/13/08: Update: Changed d* tool names to blk*.
312
313 9/17/08: Update: Finished mingw support so that both tools and
314 library work with Unicode file name support.
315
316 9/22/08: Update: Added new HFS+ code from Judson Powers and Rob Joyce (ATC-NY)
317
318 9/24/08: Bug Fix: Fixed some cygwin compile errors about types on Cygwin.
319 Reported by Phil Peacock.
320
321 9/25/08: Bug Fix: Added O_BINARY to open() in raw and split because Cygwin
322 was having problems. Reported by Mark Stam.
323
7561820 @bcarrier Added ifndef around TSK_USE_HFS
bcarrier authored
324 10/1/08: Update: Added ifndef to TSK_USE_HFS define to allow people
325 to define it on the command line. Patch by RB.
326
3a78df5 @bcarrier initial import from CVS
bcarrier authored
327
328 ---------------- VERSION 2.52 --------------
329 2/12/08: Bug Fix: Fixed warning messages in mactime about non-Numeric
330 data. Reported by Pope.
331
332 2/19/08: Bug Fix: Added #define to tsk_base_i.h to define
333 LARGEFILE64_SOURCE based on LARGEFILE_SOURCE for older Linux systems.
334
335 2/20/08: Bug Fix: Updated afflib references and code.
336
337 3/13/08: Update: Added more fixes to auto* so that AFF will compile
338 on more systems. I have confirmed that AFFLIB 3.1.3 will run with
339 OS X 10.4.11.
340
341 3/14/08: Bug Fix: Added checks to FAT code that calcs size of
342 directories. If starting cluster of deleted dir points into a
343 cluster chain, then problems can occur. Reported by John Ward.
344
345 3/19/08: Update: I have verified that this compiles with libewf-20070512.
346
347 3/21/08: Bug Fix: Deleted Ext/FFS directories were not being recursed
348 into. This case was rare (because typically the metadata are
349 wiped), but possible. Reported by JWalker.
350
351 3/24/08: Update: I have verified that this compiles with libewf-20080322.
352 Updates from Joachim Metz.
353
354 3/26/08: Update: Changed some of the header file design for the tools
355 so that the define settings in tsk_config.h can be used (for large files).
356
357 3/28/08: Update: Added config.h reference to srch_strings to get the
358 LARGEFILE support.
359
360 4/5/08: Update: Improved inode argument number parsing function.
361
362
363 ---------------- VERSION 2.51 --------------
364 1/30/08: Bug Fix: Fixed potential infinite loop in fls_lib.c. Patch
365 by Nathaniel Pierce.
366
367 2/7/08: Bug Fix: Defined some of the new constants that are used
368 in disktools because older Linux distros did not define them.
369 Reported by Russell Reynolds.
370
371 2/7/08: Bug Fix: Modified autoconf to check for large file build
372 requirements and look for new 48-bit structures needed by disktools.
373 Both of these were causing problems on older Linux distros.
374
375 2/7/08: Update: hfind will normalize hash values in database so
376 that they are case insensitive.
377
378 ---------------- VERSION 2.50 --------------
379 12/19/07: Update: Finished upgrade to autotools building design. No
380 longer include file, afflib, libewf. Resulted in many source code layout
381 changes and sorter now searches for md5, sha1, etc.
382
383 ---------------- VERSION 2.10 --------------
384 7/12/07: Update: 0s are returned for AFF pages that were not imaged.
385
386 7/31/07: Bug Fix: ifind -p could crash if a deleted file name was found
387 that did not point to a valid meta data stucture. (Reported by Andy Bontoft)
388
389 8/5/07: Update: Added NSRL support back into sorter.
390
391 8/15/07: Update: Errors are given if supplied sector offset is larger than
392 disk image. Reported by Simson Garfinkel.
393
394 8/16/07: Update: Renamed MD5 and SHA1 functions to TSK_MD5_.. and TSK_SHA_....
395
396 8/16/07: Update: tsk_error_get() does not reset the error messages.
397
398 9/26/07: Bug Fix: Changed FATFS check for valid dentries to consider
399 second values of 30. Reported by Alessandro Camillo.
400
401 10/18/07: Update: inode_walk for NTFS and FAT will not abort if
402 data corruption is found in one entry -- instead they will just
403 skip it.
404
405 10/18/07: Update: tsk_os.h uses standard gcc system names instead
406 of TSK specific ones.
407
408 10/18/07: Update: Updated raw.c to use ioctl commands on OS X to
409 get size of raw device because it does not work with SEEK_END.
410 Patch by Rob Joyce.
411
412 10/31/07: Update: Finished upgrade to fatfs_file_walk_off so that
413 walking can start at a specific offset. Also finished upgrade that
414 caches FAT run list to make the fatfs_file_walk_off more effecient.
415
416 11/14/07: Update: Fixed few places where off_t was being used
417 instead of OFF_T. Reported by GiHan Kim.
418
419 11/14/07: Update: Fixed a memory leak in aff.c to free AFF_INFO.
420 Reported by GiHan Kim.
421
422 11/24/07: Update: Finished review and update of ISO9660 code.
423
424 11/26/07: Bug Fix: Fixed 64-bit calculation in HFS+ code. Submitted
425 by Rob Joyce.
426
427 11/29/07: Update: removed linking of srch_strings.c and libtsk. Reported by
428 kwizart.
429
430 11/30/07: Upate: Made a #define TSK_USE_HFS compile flag for incorporating
431 the HFS support (flag is in src/fstools/fs_tools_i.h)
432
433 11/30/07: Update: restricted the FAT dentry sanity checks to verify
434 space padding in the name and latin-only extensions.
435
436 12/5/07: Bug Fix: fs_read_file_int had a bug that ignored the type passed
437 for NTFS files. Reported by Dave Collett.
438
439 12/12/07: Update: Changed teh FAT dentry sanity checks to allow spaces
440 in volume labels and do more checking on the attribute flag.
441
442
443
444
445 ---------------- VERSION 2.09 --------------
446 4/6/07: Bug Fix: Inifite loop in ext2 and ffs istat code because of using
447 unsigned size_t variable. Reported by Makoto Shiotsuki.
448
449 4/16/07: Bug Fix: Changed use of fseek() to fseeko() in hashtools. Patch
450 by Andy Bontoft.
451
452 4/16/07: Bug Fix: Changed Win32 SetFilePointer to use LARGE_INTEGER.
453 Reported by Kim GiHan.
454
455 4/19/07: Bug Fix: Not all FAT orphan files were being found because of
456 and offset error.
457
458 4/26/07: Bug Fix: ils -O was not working (link value not being
459 checked). Reported by Christian Perst.
460
461 4/27/07: Bug Fix: ils -r was showing UNUSED inodes. Reported by
462 Christian Perst.
463
464 5/10/07: Update: Redefined the USED and UNUSED flags for NTFS so that
465 UNUSED is set when no attributes exist.
466
467 5/16/07: Bug Fix: Fixed several bounds checking bugs that may cause
468 a crash if the disk image is corrupt. Reported by Tim Newsham (iSec
469 Partners)
470
471 5/17/07: Update: Updated AFFLIB to 2.2.11
472
473 5/17/07: Update: Updated libewf to libewf-20070512
474
475 5/17/07: Update: Updated file to 4.20
476
477 5/29/07: Update: Removed NTFS SID/SDS contributed code because it causes
478 crashes on some systems and its output is not entirely clear. (most recent bug
479 reported by Andy Scott)
480
481 6/11/07: Update: Updated AFFLIB to 2.2.12.
482
483 6/12/07: Bug Fix: ifind -p was not reporting back info on the allocated name
484 when one existed (because strtok was overwritting the name when the search
485 continued). Reported by Andy Bontoft.
486
487 6/13/07: Update: Updated file to 4.21
488
489
490 ---------------- VERSION 2.08 --------------
491 12/19/06: Bug Fix: ifind_path was not setting *result when root inode
492 was searched for. patch by David Collett.
493
494 12/29/06: Update: Removed 'strncpy' in ntfs.c to manual assignment of
495 text for '$Data' and 'N/A' for performance reasons.
496
497 1/11/07: Update: Added duname to FS_INFO that contains a string of
498 name for a file system's data unit -- Cluster for example.
499
500 1/19/07: Bug Fix: ifind_path was returning an error even after some
501 files were found. Errors are now ignored if a file was found.
502 Reported by Michael Cohen.
503
504 1/26/07: Bug Fix: Fixed calcuation of inode numbers in fatfs.c
505 (reported by Simson Garfinkel).
506
507 2/1/07: Update: Changed aff-install to support symlinked directory.
508
509 2/1/07: Update: img_open modified so that it does not report errors for
510 s3:// and http:// files that do not exist.
511
512 2/5/07: Update: updated *_read() return values to look for "<0" instead of
513 simply "== -1". (suggested by Simson Garfinkel).
514
515 2/8/07: Update: removed typedef for uintptr in WIN32 code.
516
517 2/13/07: Update: Applied patch from Kim Kulak to update HFS+ code to internal
518 design changes.
519
520 2/16/07: Update: Renamed many of the external data structures and flags
521 so that they start with TSK_ or tsk_ to prevent name collisions.
522
523 2/16/07: Update: Moved MD5 and SHA1 routines and binaries to auxtools
524 instead of hashtools so that they are more easy to access.
525
526 2/16/07: Update: started redesign and port of hashtools.
527
528 2/21/07: Update: Changed inode_walk callback API to remove the flags
529 variable -- this was redundant since flags are also in TSK_FS_INODE.
530 Same for TSK_FS_DENT.
531
532 3/7/07: Bug Fix: fs_read_file failed for NTFS resident files. Reported
533 by Michael Cohen.
534
535 3/8/07: Bug Fix: FATFS assumed a 512-byte sector in a couple of locations.
536
537 3/13/07: Update: Finished hashtools update.
538
539 3/13/07: Update: dcat reads block by block instead of all at once.
540
541 3/23/07: Update: Change ntfs_load_secure to allocate all of its
542 needed memory at once instead of doing reallocs.
543
544 3/23/07: Update: Updated AFFLIB to 2.2.0
545
546 3/24/07: Bug Fix: Fixed many locations where return value from strtoull
547 was not being properly checked and therefore invalid numbers were not
548 being detected.
549
550 3/24/07: Bug Fix: A couple of error messages in ntfs_file_walk should
551 have been converted to _RECOVER when the _RECOVERY flag was given.
552
553 3/24/07: Update: Changed behavior of ntfs_file_walk. If no type is
554 given, then a default type is chosen for files and dirs. Now, no error
555 is generated if that type does not exist -- similar to how no error is
556 generated if a FAT file has 0 file size.
557
558 3/26/07: Update: cleaned up and documented fs_data code more.
559
560 3/29/07: Update: Updated AFF to 2.2.2.
561
562 3/29/07: Update: Updated install scripts for afflib, libewf, and file to
563 touch files so that the auto* files are in the correct time stamp order.
564
565 4/5/07: Bug Fix: Added sanity checks to offsets and addresses in ExtX and
566 UFS group descriptors. Reported by Simson Garfinkel.
567
568
569 ---------------- VERSION 2.07 --------------
570 9/6/06: Update: Changed TCHAR and _T to TSK_TCHAR and _TSK_T to avoid
571 conflicts with other libraries.
572
573 9/18/06: Update: Added tsk_list_* functions and strutures.
574
575 9/18/06: Update: Added checks for recursive FAT directories.
576
577 9/20/06: Update: Changed FS_META_* flags for LINK and UNLINK and moved
578 them to ILS_? flags.
579
580 9/20/06: Update: added flags to ils to find only orphan inodes.
581
582 9/20/06: Update: Added Orphan support for FAT, NTFS, UFS, Ext2, ISO.
583
584 9/20/06: Update: File walk actions now have a flag to identify if a block
585 is SPARSE or not (used to identify if the address being passed is valid
586 or made up).
587
588 9/21/06: Update: Added file size sanity check to fatfs_is_dentry and
589 fixed assignment of fatfs->clustcnt.
590
591 9/21/06: Update: block_, inode, and dent_walk functions now do more flag
592 checking and make sure that some things are set instead of making the
593 calling code do it.
594
595 9/21/06: Update: Added checks for recursive (infinite loop) NTFS, UFS,
596 ExtX, and ISO9660 directories.
597
598 9/21/06: Update Added checks to make sure that walking the FAT for files
599 and directories would result in an infinite loop (if FAT is corrupt).
600
601 9/21/06: Update: Added -a and -A to dls to specify allocated and
602 unallocated blocks to display.
603
604 9/21/06: Update: Updated AFFLIB to 1.6.31.
605
606 9/22/06: Update: added a fs_read_file() function that allows you to read
607 random parts of a file.
608
609 10/10/06: Update: Improved performance of fs_read_file() and added
610 new FS_FLAG_META_COMP and FS_FLAG_DATA_COMP flags to show if a file
611 and data are using file system-level compression (NTFS only).
612
613 10/18/06: Bug fix: in fs_data_put_run, added a check to see
614 if the head was null before looking up. An extra error message
615 was being created for nothing.
616
617 10/18/06: Bug Fix: Added a check to the compression buffer
618 to see if it is null in _done().
619
620 10/25/06: Bug Fix: Added some more bounds checks to NTFS uncompression code.
621
622 11/3/06: Bug Fix: added check to dcat_lib in case the number of blocks
623 requested is too large.
624
625 11/07/06: Update: Added fs_read_file_noid wrapper around fs_read_file
626 interface.
627
628 11/09/06: Update: Updated AFF to 1.7.1
629
630 11/17/06: Update: Updated libewf to 20061008-1
631
632 11/17/06: Bug Fix: Fixed attribute lookup bug in fs_data_lookup.
633 Patch by David Collett.
634
635 11/21/06: Bug Fix: Fixed fs_data loops that were stopping when they hit
636 an unused attribute. Patch by David Collett.
637
638 11/21/06: Bug Fix: sorter no longer clears the path when it starts. THis
639 was causing errors on Cygwin because OpenSSL libraries could not be found.
640
641 11/22/06: Update: Added a tskGetVersion() function to return the string
642 of the current version.
643
644 11/29/06: Update: Added more tsk_error_resets to more places to prevent
645 extra error messages from being displayed.
646
647 11/30/06: Update: Added Caching to the getFAT function and to fs_read.
648
649 12/1/06: Update: Changed TSK_LIST to a reverse sorted list of buckets.
650
651 12/5/06: Bug Fix: Fixed FS_DATA_INUSE infinite loop bug.
652
653 12/5/06: Bug Fix: Fixed infinite loop bug with NTFS decompression code.
654
655 12/5/06: Update: Added NULL check to fs_inode_free (from Michael Cohen).
656
657 12/5/06: Update: Updated ifind_path so that an allocated name will be
658 shown if one exists -- do not exit if we find simply an unallocated
659 entry with an address of 0. Suggested by David Collett.
660
661 12/6/06: Update: Updated file to version 4.18.
662
663 12/6/06: Update: Updated libaff to 2.0a10 and changed build process
664 accordingly.
665
666 12/7/06: Update: Added a tsk_error_get() function that returns a string
667 with the error messages -- can be used instead of tsk_error_print.
668
669 12/7/06: Update: fixed some memory leaks in FAT and NTFS code.
670
671 12/11/06: Bug Fix: fatfs_open error message code referenced a value that
672 was in freed memory -- reordered statements.
673
674 12/15/06: Update: Include VCProj files in build.
675
676
677 ---------------- VERSION 2.06 --------------
678 8/11/06: Bug Fix: Added back in ASCII/UTF-8 checks to remove control
679 characters in file names.
680
681 8/11/06: Bug Fix: Added support for fast sym links in UFS1
682
683 8/11/06: Update: Redesigned the endian support so that getuX takes only
684 the endian flag so that the Unicode design could be changed as well.
685
686 8/11/06: Update: Redesigned the Unicode support so that there is a
687 tsk_UTF... routine instead of fs_UTF...
688
689 8/11/06: Update: Updated GPT to fully convert UTF16 to UTF8.
690
691 8/11/06: Update: There is now only one aux_tools header file to include
692 instead of libauxtools and/or aux_lib, which were nearly identical.
693
694 8/16/06: Bug Fix: ntfs_dent_walk could segfault if two consecutive
695 unallocated entries were found that had an MFT entry address of 0.
696 Reported by Robert-Jan Mora.
697
698 8/16/06: Update: Changed a lot of the header files and reduced them so
699 that it is easier to use the library and only one header file needs to
700 be included.
701
702 8/21/06: Update: mmtools had char * instead of void * for walk callback
703
704 8/22/06: Update: Added fs_load_file function that returns a buffer full
705 with the contents of a file.
706
707 8/23/06: Update: Upgraded AFFLIB to 1.6.31 and libewf to 20060820-1.
708
709 8/25/06: Update: Created printf wrappers so that output is UTF-16 on
710 Windows and UTF-8 on Unix.
711
712 8/25/06: Update: Continued port to Windows by starting to use more
713 TCHARS and defining needed macros for the Unix side.
714
715 8/25/06: Bug Fix: Fixed crash that could occur because of SDS code
716 in NTFS. (reported by Simson Garfinkel) (BUG: 1546925).
717
718 8/25/06: Bug Fix: Fixed crash that could occur because path stack became
719 corrupt with deep directories or corrupt images. (reported by Simson
720 Garfinkel) (BUG: 1546926).
721
722 8/25/06: Bug Fix: Fixed infinite loop that could occur when trying to
723 determine size of FAT directory when the FAT has a loop in it. (BUG:
724 1546929)
725
726 8/25/06: Update: Improved FAT checking code to look for '.' and '..'
727 entries when inode value is replaced during dent_walk.
728
729 8/29/06: Update: Finished Win32 port and changes to handle UTF-16 vs
730 UTF-8 inputs.
731
732 8/29/06: Update: Created a parse_inum function to handle parsing inode
733 addresses from command line.
734
735 8/30/06: Update: Made progname a local variable instead of global.
736
737 8/31/06: Bug Fix: Fixed a sizeof() error with the memset in fatfs_inode_walk
738 for the sect_alloc buffer.
739
740 8/31/06: Update: if mktime in dos2unixtime returns any negative value,
741 then the return value is set to 0. Windows and glibc seem to have
742 different return values.
743
744 ---------------- VERSION 2.05 --------------
745 5/15/06: Bug Fix: Fixed a bug in img_cat that could cause it to
746 go into an infinite loop. (BUG: 1489284)
747
748 5/16/06: Update: Fixed printf statements in tsk_error.c that caused
749 warning messages for some compilers. Reported by Jason DePriest.
750
751 5/17/06: Update: created a union of file system-specific file times in
752 FS_INFO (Patch by Wyatt Banks)
753
754 5/22/06: Bug Fix: Updated libewf to 20060520 to fix bug with reported
755 image size. (BUG: 1489287)
756
757 5/22/06: Bug Fix: Updated AFFLIB to 1.6.24 so that TSK could compile in
758 CYGWIN. (BUG: 1493013)
759
760 5/22/06: Update: Fixed some more printf statements that were causing
761 compile warnings.
762
763 5/23/06: Update: Added a file existence check to img_open to make error
764 message more accurate.
765
766 5/23/06: Update: Usage messages had extra "Supported image types message".
767
768 5/25/06: Update: Added block / page range to fsstat for raw and swapfs.
769
770 6/5/06: Update: fixed some typos in the output messages of sigfind (reported
771 by Jelle Smet)
772
773 6/9/06: Update: Added HFS+ template to sigfind (Patch by Wyatt Banks)
774
775 6/9/06: Update: Added ntfs and HFS template to sigfind.
776
777 6/19/06: Update: Begin Windows Visual Studio port
778
779 6/22/06: Update: Updated a myflags check in ntfs.c (reported by Wyatt Banks)
780
781 6/28/06: Update: Incorporated NTFS compression patch from I.D.E.A.L.
782
783 6/28/06: Update: Incorporated NTFS SID patch from I.D.E.A.L.
784
785 6/28/06: Bug Fix: A segfault could occur with NTFS if no inode was loaded
786 in the dent_walk code. (Reported by Pope).
787
788 7/5/06: Update: Added tsk_error_reset function and updated code to use it.
789
790 7/5/06: Update: Added more sanity checks to the DOS partitions code.
791
792 7/10/06: Update: Upgraded libewf to version 20060708.
793
794 7/10/06: Update: Upgraded AFFLIB to version 1.6.28
795
796 7/10/06: Update: added 'list' option to usage message so that file
797 system, image, volume system types are listed only if '-x list' is given.
798 Suggested by kenshin.
799
800 7/10/06: Update: Compressed NTFS files use the compression unit size
801 specified in the header.
802
803 7/10/06: Update: Added -R flag to icat to suppress recovery warnings and
804 use this flag in sorter to prevent FAT recovery messages from filling
805 up screen.
806
807 7/10/06: Update: file_walk functions now return FS_ERR_RECOVERY error
808 codes for most cases if the RECOVERY flag is set -- this allows the
809 errors to be more easily suppressed.
810
811 7/12/06: Update: Removed individual libraries and now make a single
812 static libtsk.a library.
813
814 7/12/06: Update: Cleaned up top-level Makefile. Use '-C' flag (suggested
815 by kenshin).
816
817 7/14/06: Update: Fixed and redesigned some of the new NTFS compression
818 code. Changed variable names.
819
820 7/20/06: Update: Fixed an NTFS compression bug if a sub-block was not
821 compressed.
822
823 7/21/06: Update: Made NTFS compression code thread friendly.
824
825
826 ---------------- VERSION 2.04 --------------
827 12/1/05: Bug Fix: Fixed a bug in the verbose output of img_open
828 that would crash if no type or offset was given. Reported and
829 patched by Wyatt Banks.
830
831 12/20/05: Bug Fix: An NTFS directory index sanity check used 356
832 instead of 365 when calculating an upper bound on the times. Reported
833 by Wyatt Banks.
834
835 12/23/05: Bug Fix: Two printf statements in istat for NTFS printed
836 to stdout instead of a specific file handle. Reported by Wyatt
837 Banks.
838
839 1/22/06: Bug Fix: fsstat, imgstat and dcalc were using a char instead
840 of int for the return value of getopt, which caused some systems to not
841 execute the programs. (internal fix and later reported by Bernhard Reiter)
842
843 2/23/06: Update: added support for FreeBSD 6.
844
845 2/27/06: Bug Fix: Indirect blocks would nto be found by ifind with
846 UFS and Ext2. Reported by Nelson G. Mejias-Diaz. (BUG: 1440075)
847
848 3/9/06: Update: Added AFF image file support.
849
850 3/14/06: Bug Fix: If the first directory entry of a UFS or ExtX block
851 was unallocated, then later entries may not be shown. Reported by John
852 Langezaal. (BUG: 1449655)
853
854 4/3/06: Update: Finished the improved error handling. Many internal
855 changes, not many external changes. error() function no longer used
856 and instead tsk_err variables and function are used. This makes the
857 library more powerful.
858
859 4/5/06: Update: The byte offset for a volume is now passed to the mm_
860 and fs_ functions instead of img_open. This allows img_info to be used
861 for multiple volumes at the same time. This required some mm_ changes.
862
863 4/5/06: Update: All TSK libraries are written to the lib directory.
864
865 4/6/06: Update: Added FS_FLAG_DATA_RES flag to identify data that are
866 resident in ntfs_data_walk (suggested by Michael Cohen).
867
868 4/6/06: Update: The partition code (media Management) now checks that a
869 partition starts before the end of the image file. There are currently
870 no checks about the end of the partition though.
871
872 4/6/06: Update: The media management code now shows unpartitioned space
873 as such from the end of the last partition to the end of the image file
874 (using the image file size). (Suggested by Wyatt Banks).
875
876 4/7/06: Update: New version of ISO9660 code from Wyatt Banks and Crucial
877 Security added and other code updated to allow CDs to be analyzed.
878
879 4/7/06: There was a conflict with guessuXX with mmtools and fstools.
880 Renamed to mm_guessXX and fs_guessXX.
881
882 4/10/06: Upgraded AFFLIB to 1.5.6
883
884 4/12/06: Added version of libewf and support for it in imgtools
885
886 4/13/06: Added new img_cat tool to extract raw data from an image format.
887
888 4/24/06: Upgraded AFFLIB to 1.5.12
889
890 4/24/06: split and raw check if the image is a directory
891
892 4/24/06: Updated libewf to 20060423-1
893
894 4/26/06: Updated makedefs to work with SunOS 5.10
895
896 5/3/06: Added iso9660 patch from Wyatt Banks so that version number
897 is not printed with file name.
898
899 5/4/06: Updated error checking in icat, istat, fatfs_dent, and ntfs_dent
900
901 5/8/06: Updated libewf to 20060505-1 to fix some gcc 2 compile errors.
902
903 5/9/06: Updated AFFLIB to 1.6.18
904
905 5/11/06: Cleaned up error handling (removed %m and unused legacy code)
906
907 5/11/06: Updated AFFLIB to 1.6.23
908
909 ---------------- VERSION 2.03 --------------
910 7/26/05: Update: Removed incorrect print_version() statement from
911 fs_tools.h (reported by Jaime Chang)
912
913 7/26/05: Update: Renamed libraries to start with "lib"
914
915 7/26/05: Update: Removed the logfp variable for verbose statements
916 and instead use only stderr.
917
918 8/12/05: Update: If time is 0, then it is put as 00:00:00 instead of
919 the default 1970 or 1980 time.
920
921 8/13/05: Update: Added Unicode support for FAT and NTFS (Supported by
922 I.D.E.A.L. Technology Corp).
923
924 9/2/05: Update: Added Unicode support for UFS and ExtX. Non-printable
925 ASCII characters are no longer replaced with '^.'.
926
927 9/2/05: Update: Improved the directory entry sanity checks for UFS
928 and ExtX.
929
930 9/2/05: Update: Upgraded file to version 4.15.
931
932 9/2/05: Update: The dent_walk code of all file systems does not
933 abort if a sub-directory is encountered with an error. If it is the
934 top directory explicitly called, then it still gives an error.
935
936 9/2/05: Bug Fix: MD5 and SHA-1 values were incorrect under AMD64
937 systems because the incorrect variable sizes were being used.
938 (reported by: Regis Friend Cassidy. BUG: 1280966)
939
940 9/2/05: Update: Changed all licenses in TSK to Common Public License
941 (except those that were already IBM Public License).
942
943 9/15/05: Bug Fix: The Unicode names would not be displayed if the FAT
944 short name entry was using code pages. The ASCII name check was removed,
945 which may lead to more false positives during inode_walk.
946
947 10/05/05: Update: improved the sector size check when the FAT boot
948 sector is read (check for specific values besides just mod 512).
949
950 10/12/05: Update: The ASCII name check was added back into FAT, but
951 the check no longer looks for values over 0x80.
952
953 10/12/05: Update: The inode_walk function in FAT skips clusters
954 that are allocated to files. This makes it much faster, but it
955 will now not find unallocated directory entries in the slack space
956 of allocated files.
957
958 10/13/05: Update: sorter updated to handle unicode in HTML output.
959
960 ---------------- VERSION 2.02 --------------
961 4/27/05: Bug Fix: the sizes of 'id' were not consistent in the
962 front-end and library functions for icat and ffind. Reported by
963 John Ward.
964
965 5/16/05: Bug Fix: fls could segfault in FAT if short name did not
966 exist. There was also a bug where the long file name variable
967 (fatfs->lfn_len) was not reset after processing a directory and the
968 next entry could incorrectly get the long name. Reported by Jaime
969 Chang. BUG: 1203673.
970
971 5/18/05: Update: Updated makedefs to support Darwin 8 (OS X Tiger)
972
973 5/23/05: Bug Fix: ntfs_dent_walk would not always stop when WALK_STOP
974 was returned. This caused some issues with previous versions of ifind.
975 This was fixed.
976
977 5/24/05: Bug Fix: Would not compile under Suse because it had header
978 file conflicts for the size of int64_t. Reported by: Andrea Ghirardini.
979 BUG: 1203676
980
981 5/25/05: Update: Fixed some memory leaks in fstools (reported by Jaime
982 Chang).
983
984 6/13/05: Update: Compiled with g++ to get better warning messages.
985 Fixed many signed versus unsigned comparisons, -1 assignments to
986 unsigned vars, and some other minor internal issues.
987
988 6/13/05: Bug Fix: if UFS or FFS found a valid dentry in unallocated
989 space, it could have a documented length that is larger than the
990 remaining unallocated space. This would cause an allocated name
991 to be skipped. BUG: 1210204 Reported by Christopher Betz.
992
993 6/13/05: Update: Improved design of all dent code so that there are no
994 more global variables.
995
996 6/13/05: Update: Improved design of FAT dent code so that FATFS_INFO
997 does not keep track of long file name information.
998
999 6/13/05: Bug Fix: If a cluster in a directory started with a strange
1000 dentry, then FAT inode_walk would skip it. The fixis to make sure
1001 that all directory sectors are processed. (BUG: 1203669). Reported
1002 by Jaime Chang.
1003
1004 6/14/05: Update: Changed design of FS_INODE so that it contains the
1005 inode address and the inode_walk action was changed to remove inum
1006 as an argument.
1007
1008 6/15/05: Update: Added 'ils -o' back in as 'ils -O' to list open
1009 and deleted files.
1010
1011 6/15/05: Update: Added '-m' flag to mactime so that it prints the month
1012 as a number instead of its name.
1013
1014 7/2/05: Bug Fix: If an NTFS file did not have a $DATA or $IDX_*
1015 attribute, then fls would not print it. The file had no content, but
1016 the name should be shown. (BUG: 1231515) (Reported by Fuerst)
1017
1018
1019 ---------------- VERSION 2.01 --------------
1020 3/24/05: Bug Fix: ffind would fail if the directory had two
1021 non-printable chars. The handling of non-printable chars was changed
1022 to replace with '^.'. (BUG: 1170310) (reported by Brian Baskin)
1023
1024 3/24/05: Bug Fix: icat would not print the output to stdout when split
1025 images were used. There was a bug in the image closing process of
1026 icat. (BUG: 1170309) (reported by Brian Baskin)
1027
1028 3/24/05: Update: Changed the header files in fstools to make fs_lib.h
1029 more self contained.
1030
1031 4/1/05: Bug Fix: Imgtools byte offset with many leading 0s could
1032 cause issues. (BUG: 1174977)
1033
1034 4/1/05: Update: Removed test check in mmtools/dos.c for value cluster
1035 size because to many partition tables have that as a valid field.
1036 Now it checks only OEM name.
1037
1038 4/8/05: Update: Updated usage of 'strtoul' to 'strtoull' for blocks
1039 and inodes.
1040
1041 ---------------- VERSION 2.00 --------------
1042 1/6/05: Update: Added '-b' flag to 'mmls' so that sizes can be
1043 printed in bytes. Suggested and a patch proposed by Matt Kucenski
1044
1045 1/6/05: Update: Define DADDR_T, INUM_T, OFF_T, PNUM_T as a static
1046 size and use those to store values in data structures. Updated
1047 print statements as well.
1048
1049 1/6/05: Update: FAT now supports larger images becuase the inode
1050 address space is 64-bits.
1051
1052 1/6/05: Moved guess and get functions to misc from mmtools and
1053 fstools.
1054
1055 1/7/05: Update: Added imgtools with support for "raw" and "split"
1056 layers. All fstools have been updated.
1057
1058 1/7/05: Update: removed dtime from ils output
1059
1060 1/9/05: Update: FAT code reads in clusters instead of sectors to
1061 be faster (suggested by David Collett)
1062
1063 1/9/05: Update: mmtools uses imgtools for split images etc.
1064
1065 1/10/05: Update: Removed usage of global variables when using
1066 file_walk internally.
1067
1068 1/10/05: Update: mmls BSD will use the next sector automatically
1069 if the wrong is given instead of giving an error.
1070
1071 1/10/05: Update: Updated file to version 4.12
1072
1073 1/11/05: Update: Added autodetect to file system tools.
1074
1075 1/11/05: Update: Changed names to specify file system type (not
1076 OS-based)
1077
1078 1/11/05: Update: Added '-t' option to fsstat to give just the type.
1079
1080 1/11/05: Update: Added autodetect to mmls
1081
1082 1/17/05: Update: Added the 'mmstat' tool that gives the type of
1083 volume system.
1084
1085 1/17/05: Update: Now using CVS for local version control - added
1086 date stamps to all files.
1087
1088 2/20/05: Bug Fix: ils / istat would go into an infinte loop if the
1089 attribute list had an entry with a length of 0. Reported by Angus
1090 Marshall (BUG: 1144846)
1091
1092 3/2/05: Update: non-printable letters in ExtX/UFS file names are
1093 now replaced by a '.'
1094
1095 3/2/05: Update: Made file system tools more library friendly by
1096 making stubs for each application.
1097
1098 3/4/05: Update: Redesigned the diskstat tool and created the
1099 disksreset tool to remove the HPA temporarily.
1100
1101 3/4/05: Update: Added imgstat tool that displays image format
1102 details
1103
1104 3/7/05: Bug Fix: In fsstat on ExtX, the final group would have an
1105 incorrect _percentage_ of free blocks value (although the actual
1106 number was correct). Reported by Knut Eckstein. (BUG: 1158620)
1107
1108 3/11/05: Update: Renamed diskstat, disksreset, sstrings, and imgstat to
1109 disk_stat, disk_sreset, srch_strings, and img_stat to make the names more
1110 clear.
1111
1112 3/13/05: Bug Fix: The verbose output for fatfs_file_walk had an
1113 incorrect sector address. Reported by Rudolph Pereira.
1114
1115 3/13/05: Bug Fix: The beta version had compiling problems on FreeBSD
1116 because of a naming clash with the new 'fls' functions. (reported
1117 by secman)
1118
1119
1120
1121 ---------------- VERSION 1.74 --------------
1122 11/18/04: Bug Fix: FreeBSD 5 would produce incorrect 'icat' output for
1123 Ext2/3 & UFS1 images because it used a 64-bit on-disk address.
1124 reported by neutrino neutrino. (BUG: 1068771)
1125
1126 11/30/04: Bug Fix: The makefile in disktools would generate an error
1127 on some systems (Cygwin) because of an extra entry. Reported by
1128 Vajira Ganepola (BUG: 1076029)
1129
1130
1131 ---------------- VERSION 1.73 --------------
1132 09/09/04: Update: Added journal support for EXT3FS and added jls
1133 and jcat tools.
1134
1135 09/13/04: Updated: Added the major and minor device numbers to
1136 EXTxFS istat.
1137
1138 09/13/04: Update: Added EXTxFS orphan code to 'fsstat'
1139
1140 09/24/04: Update: Fixed incorrect usage of 'ptr' and "" in action
1141 of ntfs_dent.c. Did not affect any code, but could have in the
1142 future. Reported by Pete Winkler.
1143
1144 09/25/04: Update: Added UFS flags to fsstat
1145
1146 09/26/04: Update: All fragments are printed for indirect block pointer
1147 addresses in UFS istat.
1148
1149 09/29/04: Update: Print extended UFS2 attributes in 'istat'
1150
1151 10/07/04: Bug Fix: Changed usage of (int) to (uintptr_t) for pointer
1152 arithmetic. Caused issues with Debian Sarge. (BUG: 1049352) - turned out
1153 to be from changes made to package version so that it would compile in
1154 64-bit system (BUG: 928278).
1155
1156 10/11/04: Update: Added diskstat to check for HPA on linux systems.
1157
1158 10/13/04: Update: Added root directory location to FAT32 fsstat output
1159
1160 10/17/04: Bug Fix: EXTxFS superblock location would not be printed
1161 for images in fsstat that did not have sparse superblok (which is
1162 rare) (BUG: 1049355)
1163
1164 10/17/04: Update: Added sigfind tool to find binary signatures.
1165
1166 10/27/04: Bug Fix: NTFS is_clust_alloc returned an error when loading
1167 $MFT that had attribute list entry. Now I assume that clusters
1168 referred to by the $MFT are allocated until the $MFT is loaded.
1169 (BUG: 1055862).
1170
1171 10/28/04: Bug Fix: Check to see if an attribute with the same name
1172 exists instead of relying on id only. (ntfs_proc_attrseq) Affects
1173 the processing of attribute lists. Reported by Szakacsits Szabolcs,
1174 Matt Kucenski, & Gene Meltser (BUG: 1055862)
1175
1176 10/28/04: Update: Removed usage of mylseek in fstools for all systems
1177 (Bug: 928278)
1178
1179
1180 ---------------- VERSION 1.72 --------------
1181 07/31/04: Update: Added flag to mft_lookup so that ifind can run in noabort
1182 mode and it will not stop when it finds an invalid magic value.
1183
1184 08/01/04: Update: Removed previous change and removed MAGIC check
1185 entirely. XP doesn't even care if the Magic is corrupt, so neither
1186 does TSK. The update sequence check should find an invalid MFT
1187 entry.
1188
1189 08/01/04: Update: Added error message to 'ifind' if none of the search
1190 options are given.
1191
1192 08/05/04: Bug Fix: Fixed g_curdirptr recursive error by clearing the value
1193 when dent_walk had to abort because a deleted directory could not be recovered.
1194 (BUG: 1004329) Reported by epsilon@yahoo.com
1195
1196 08/16/04: Update: Added a sanity check to fatfs.c fat2unixtime to check
1197 if the year is > 137 (which is the overflow date for the 32-bit UNIX time).
1198
1199 08/16/04: Update: Added first version of sstrings from binutils-2.15
1200
1201 08/20/04: Bug Fix: Fixed a bug where the group number for block 0 of an
1202 EXT2FS file system would report -1. 'dstat' no longer displays value when it
1203 is not part of a block group. (BUG: 1013227)
1204
1205 8/24/04: Update: If an attribute list entry is found with an invalid MFT
1206 entry address, then it is ignored instead of an error being generated and
1207 exiting.
1208
1209 8/26/04: Update: Changed internal design of NTFS to make is_clust_alloc
1210
1211 8/26/04: Update: If an attribute list entry is found with an invalid MFT
1212 entry address AND the entry is unallocated, then no error message is
1213 printed, it is just ignored or logged in verbose mode.
1214
1215 8/29/04: Update: Added support for 32-bit GID and UID in EXTxFS
1216
1217 8/30/04: Bug Fix: ntfs_dent_walk was adding 24 extra bytes to the
1218 size of the index record for the final record processing (calc of
1219 list_len) (BUG: 1019321) (reported and debugging help from Matt
1220 Kucenski).
1221
1222 8/30/04: Bug Fix: fs_data_lookup was using an id of 0 as a wild
1223 card, but 0 is a legit id value and this could cause confusion. To
1224 solve this, a new FS_FLAG_FILE_NOID flag was added and a new
1225 fs_data_lookup_noid function that will not use the id to lookup
1226 values. (BUG: 1019690) (reported and debugging help from Matt
1227 Kucenski)
1228
1229 8/30/04: Update: modified fs_data_lookup_noid to return unamed data
1230 attribute if that type is requested (instead of just relying on id
1231 value in attributes)
1232
1233 8/31/04: Update: Updated file to v4.10, which seems to fix the
1234 CYGWIN compile problem.
1235
1236 9/1/04: Update: Added more DOS partition types to mmls (submitted by
1237 Matt Kucenski)
1238
1239 9/2/04: Update: Added EXT3FS extended attributes and Posix ACL to istat
1240 output.
1241
1242 9/2/04: Update: Added free inode and block counts per group to fsstat for
1243 EXT2FS.
1244
1245 9/7/04: Bug Fix: FreeBSD compile error for PRIx printf stuff in mmtools/gpt.c
1246
1247
1248 ---------------- VERSION 1.71 --------------
1249 06/05/04: Update: Added sanity checks in fat to unix time conversion so that
1250 invalid times are set to 0.
1251
1252 06/08/04: Bug Fix: Added a type cast when size is assigned in FAT
1253 and removed the assignment to a 32-bit signed variable (which was no
1254 longer needed). (Bug: 966839)
1255
1256 06/09/04: Bug Fix: Added a type cast to the 'getuX' macros because some
1257 compilers were assuming it was signed (Bug: 966839).
1258
1259 06/11/04: Update: Changed NTFS magic check to use the aa55 at the
1260 end and fixed the name of the original "magic" value to oemname.
1261 The oemname is now printed in fsstat.
1262
1263 06/12/04: Bug Fix: The NTFS serial number was being printed with
1264 bytes in the wrong order in the fsstat output. (BUG: 972207)
1265
1266 06/12/04: Update: The begin offset value in index header for NTFS
1267 was 16-bits instead of 32-bits.
1268
1269 06/22/04: Update: Created a library for the MD5 and SHA1 functions so
1270 that it can be incorporated into other tools. Also renamed some of the
1271 indexing tools that hfind uses.
1272
1273 06/23/04: Update: Changed output of 'istat' for NTFS images. Added more
1274 data from $STANDARD_INFORMATION.
1275
1276 07/13/04: Update: Changed output of 'istat' for NTFS images again. Moved
1277 more data to the $FILE_NAME section and added new data.
1278
1279 07/13/04: Update: Changed code for processing NTFS runs and no
1280 longer check for the offset to be 0 in ntfs_make_data_run(). This
1281 could have prevented some sparse files from being processed.
1282
1283 07/13/04: Update: Added flags for compressed and encrypted NTFS
1284 files. They are not decrypted or uncompressed yet, just identified.
1285 They cannot be displayed from 'icat', but the known layout is given
1286 in 'istat'.
1287
1288 07/18/04: Bug Fix: Sometimes, 'icat' would report an error about an
1289 existing FILLER entry in an NTFS attribute. This was traced to
1290 instances when it was run on a non-base file record. There is now
1291 a check for that to not show the error. (BUG: 993459)
1292
1293 07/19/04: Bug Fix: A run of -1 may exist for sparse files in non-NT
1294 versions of NTFS. Changed check for this. reported by Matthew
1295 Kucenski. (BUG: 994024).
1296
1297 07/24/04: Bug Fix: NTFS attribute names were missing (rarely) on
1298 some files because the code assumed they would always be at offset
1299 64 for non-res attributes (Bug: 996981).
1300
1301 07/24/04: Update: Made listing of unallcoated NTFS file names less
1302 strict. There was a check for file name length versus stream length.
1303
1304 07/24/04: Update: Added $OBJECT_ID output to 'istat'
1305
1306 07/24/04: Update: Fixed ntfs.c compile warning about constant too
1307 large in time conversion code.
1308
1309 07/25/04: Update: Added attribute list contents to NTFS 'istat' output
1310
1311 07/25/04: Bug Fix: Not all slack space was being shown with 'dls -s'.
1312 It was documented that this occurs, but it is not what would be
1313 expected. (BUG: 997800).
1314
1315 07/25/04: Update: Changed output format of 'dls -s' so that it sends
1316 zeros where the file content was. Therefore the output is now a
1317 multiple of the data unit size. Also removed limitation to FAT &
1318 NTFS.
1319
1320 07/25/04: Update: 'dcalc' now has the '-s' option calculate the
1321 original location of data from a slack space image (dls -s).
1322 (from Chris Betz).
1323
1324 07/26/04: Update: Created the fs_os.h file and adjusted some of the
1325 header files for the PRI macros (C99). Created defines for OSes that do
1326 not have the macros already defined.
1327
1328 07/26/04: Non-release bug fix: Fixed file record size bug introduced with
1329 recent changes.
1330
1331 07/27/04: Update: Added GPT support to mmls.
1332
1333 07/29/04: Update: Added '-p' flag to 'ifind' to find deleted NTFS files
1334 that point to the given parent directory. Added '-l and -z' as well.
1335
1336
1337 ---------------- VERSION 1.70 --------------
1338 04/21/04: Update: Changed attribute and mode for FAT 'istat' so
1339 that actual FAT attributes are used instead of UNIX translation.
1340
1341 04/21/04: Update: The FAT 'istat' output better handles Long FIle
1342 Name entry
1343
1344 04/21/04: Update: The FAT 'istat' output better handles Volume Label
1345 entry
1346
1347 04/21/04: Update: Allowed the FAT volume label entry to be displayed
1348 with 'ils'
1349
1350 04/21/04: Update: Allowed the FAT volume label entry to be displayed
1351 with 'fls'
1352
1353 04/24/04: Update: 'dstat' on a FAT cluster now shows the cluster
1354 address in addition to the sector address.
1355
1356 04/24/04: Update: Added the cluster range to the FAT 'fsstat' output
1357
1358 05/01/04: Update: Improved the FAT version autodetect code.
1359
1360 05/02/04: Update: Removed 'H' flag from 'icat'.
1361
1362 05/02/04: Update: Changed all of the FS_FLAG_XXX variables in the
1363 file system tools to constants that are specific to the usage
1364 (NAME, DATA, META, FILE).
1365
1366 05/03/04: Update: fatfs_inode_walk now goes by sectors instead of clusters
1367 to get more dentries from slack space.
1368
1369 05/03/04: Bug Fix: The allocation status of FAT dentires was set only by
1370 the flag and not the allocation status of the cluster it is located in.
1371 (BUG: 947112)
1372
1373 05/03/04: Update: Improved comments and variable names in FAT code
1374
1375 05/03/04: Update: Added '-r' flag to 'icat' for deleted file recovery
1376
1377 05/03/04: Update: Added RECOVERY flag to file_walk for deleted file
1378 recovery
1379
1380 05/03/04: Update: Added FAT file recovery.
1381
1382 05/03/04: Update: Removed '-H' flag from 'icat'. Default is to
1383 display holes.
1384
1385 05/03/04: Update: 'fls -r' will recurse down deleted directories in FAT
1386
1387 05/03/04: Update: 'fsstat' reports FAT clusters that are marked as BAD
1388
1389 05/03/04: Update: 'istat' for FAT now shows recovery clusters for
1390 deleted files.
1391
1392 05/04/04: Update: Added output to 'fsstat' for FAT file systems by adding
1393 a list of BAD sectors and improving the amount of layout information. I
1394 also changed some of the internal variables.
1395
1396 05/08/04: Update: Removed addr_bsize from FS_INFO, moved block_frags
1397 to FFS_INFO, modified dcat output only data unit size.
1398
1399 05/20/04: Update: Added RECOVERY flag to 'ifind' so that it can find the
1400 data units that are allocated to deleted files
1401
1402 05/20/04: Update: Added icat recovery options to 'sorter'.
1403
1404 05/20/04: Update: Improved the naming convention in sorter for the 'ils'
1405 dead files.
1406
1407 05/21/04: Update: Added outlook to sorter rules (from David Berger)
1408
1409 05/27/04: Bug Fix: Added <linux/unistd.h> to mylseek.c so that it compiles
1410 with Fedora Core 2 (Patch by Angus Marshall) (BUG: 961908).
1411
1412 05/27/04: Update: Changed the letter with 'fls -l' for FIFO to 'p'
1413 instead of 'f' (reported by Dave Henkewick).
1414
1415 05/28/04: Update: Added '-u' flag to 'dcat' so that the data unit size
1416 can be specified for raw, swap, and dls image types.
1417
1418 05/28/04: Update: Changed the size argument of 'dcat' to be number of
1419 data units instead of size in bytes (suggestion by Harald Katzer).
1420
1421
1422 ---------------- VERSION 1.69 --------------
1423 03/06/04: Update: Fixed some memory leaks in ext2fs_close. reported
1424 by Paul Bakker.
1425 03/10/04: Bug Fix: If the '-s' flag was used with 'icat' on a EXT2FS
1426 or FFS file system, then a large amount of extra data came out.
1427 Reported by epsion. (BUG: 913874)
1428 03/10/04: Bug Fix: One of the verbose outputs in ext2fs.c was being sent
1429 to STDOUT instead of logfp. (BUG: 913875)
1430 04/14/04: Update: Added more data to fsstat output of FAT file system.
1431 04/15/04: Bug Fix: The last sector of a FAT file system may not
1432 be analyzed. (BUG: 935976)
1433 04/16/04: Update: Added full support for swap and raw by making the
1434 standard files and functions for them instead of the hack in dcat.
1435 Suggested by (and initial patch by) Paul Baker.
1436 04/18/04: Update: Changed error messages in EXT2/3FS code to be extXfs.
1437 04/18/04: Update: Updaged to version 4.09 of 'file'. This will
1438 help fix some of the problems people have had compiling it under
1439 OS X 10.3.
1440 04/18/04: Update: Added compiling support for SFU 3.5 (Microsoft). Patches
1441 from an anonymous person.
1442
1443
1444 ---------------- VERSION 1.68 --------------
1445 01/20/04: Bug Fix: FAT times were an hour too fast during daylight savings.
1446 Now use mktime() instead of manual calculation. Reported by Randall
1447 Shane. (BUG: 880606)
1448 02/01/04: Update: 'hfind -i' now reports the header entry as an invalid
1449 entry. The first header row was ignored.
1450 02/20/04: Bug Fix: indirect block pointer blocks would not be identified by
1451 the ifind tool. Reported by Knut Eckstein (BUG: 902709)
1452 03/01/04: Update: Added fs->seek_pos check to fs_read_random.
1453
1454 ---------------- VERSION 1.67 --------------
1455 11/15/03: Bug Fix: Added support for OS X 10.3 to src/makedefs. (BUG: 843029)
1456 11/16/03: Bug Fix: Mac partition tables could generate an error if there were
1457 VOID-type partitions. (BUG: 843366)
1458 11/21/03: Update: Changed NOABORT messages to verbose messages, so invalid
1459 data is not printed during 'ifind' searches.
1460 11/30/03: Bug Fix: icat would not hide the 'holes' if '-h' was given because
1461 the _UNALLOC flag was always being passed to file_walk. (reported by
1462 Knut Eckstein). (BUG: 851873)
1463 11/30/03: Bug Fix: NTFS data_walk was not using _ALLOC and _UNALLOC flags
1464 and other code that called it was not either. (BUG: 851895)
1465 11/30/03: Bug Fix: Not all needed commands were using _UNALLOC when they
1466 called file_walk (although for most cases it did not matter because
1467 sparse files would not be found in a directory for example). (Bug: 851897)
1468 12/09/03: Bug Fix: FFS and EXT2FS code was using OFF_T type instead of
1469 size_t for the size of the file. This could result in a file > 2GB
1470 as being a negative size on some systems (BUG: 856957).
1471 12/26/03: Bug Fix: ffind would crash for root directory of FAT image.
1472 Added NULL check and added a NULL name to fake root directory entry.
1473 (BUG: 871219)
1474 01/05/04: Bug Fix: The clustcnt value for FAT was incorrectly calculated
1475 and was too large for FAT12 and FAT16 by 32 sectors. This could produce
1476 extra entries in the 'fsstat' output when the FAT is dumped.
1477 (BUG: 871220)
1478 01/05/04: Bug Fix: ils, fls, and istat were not printing the full size
1479 of files that are > 2GB. (reported by Knut Eckstein) (BUG: 871457)
1480 01/05/04: Bug Fix: The EXT2FS and EXT3FS code was not using the
1481 i_dir_acl value as the upper 32-bits of regular files that are
1482 > 2GB (BUG: 871458)
1483 01/06/04: Mitigation: An error was reported where sorter would error
1484 that icat was being passed a '-1' argument. I can't find how that would
1485 happen, so I added quotes to all arguments so that the next time it
1486 occurs, the error is more useful (BUG: 845840).
1487 01/06/04: Update: Incorporated patch from Charles Seeger so that 'cc'
1488 can be used and compile time warnings are fixed with Sun 'cc'.
1489 01/06/04: Update: Upgraded file from v3.41 to v4.07
1490
1491
1492 ---------------- VERSION 1.66 --------------
1493 09/02/03: Bug Fix: Would not compile under OpenBSD 3 because fs_tools.h
1494 & mm_tools was missing a defined statment (reported by Randy - m0th_man)
1495 NOTE: Bugs now will have an entry into the Source Forge bug tracking
1496 sytem.
1497 10/13/03: Bug Fix: buffer was not being cleared between uses and length
1498 incorrectly set in NTFS resulted in false deleted file names being shown
1499 when the '-r' flag was given. The extra entries were from the previous
1500 directory. (BUG: 823057)
1501 10/13/03: Bug Fix: The results of 'sorter' varied depending on the version
1502 of Perl and the system. If the file output matched more than one,
1503 sorter could not gaurantee which would match. Therefore, results were
1504 different for some files and some machines. 'sorter' now enforces the
1505 ordering based on the order they are in the configuration file. The
1506 entries at the end of the file have priority over the first entries
1507 (generic rules to specific rules). (BUG: 823057)
1508 10/14/03: Update: 'mmls' prints 'MS LVM' with partition type 0x42 now.
1509 10/25/03: Bug Fix: NTFS could have a null pointer crash if the image
1510 was very corrupt and $Data was not found for the MFT.
1511 11/10/03: Bug Fix: NTFS 'ffind' would only report the file name and not
1512 the attribute name because the type and id were ignored. ffind and
1513 ntfs_dent were updated - found during NTFS keyword search test.
1514 (Bug: 831579()
1515 11/12/03: Update: added support for Solaris x86 partition tables to 'mmls'
1516 11/12/03: Update: Modified the sparc data structure to add the correct
1517 location of the 'sanity' magic value.
1518 11/15/03: Update: Added '-s' flag to 'icat' so that slack space is also
1519 displayed.
1520
1521 ---------------- VERSION 1.65 --------------
1522 08/03/03: Bug Fix: 'sorter' now checks for inode values that are too
1523 small to avoid 'icat' errors about invalid inode values.
1524 08/19/03: Update: 'raw' is now a valid type for 'dcat'.
1525 08/21/03: Update: mactime and sorter look for perl5.6.0 first.
1526 08/21/03: Update: Removed NSRL support from 'sorter' until a better
1527 wany to identify the known good and known bad files is found
1528 08/21/03: Bug Fix: The file path replaces < and > with HTML
1529 encoding for HTML output (ils names were not being shown)
1530 08/25/03: Update: Added 'nsrl.txt' describing why the NSRL functionality
1531 was removed.
1532 08/27/03: Update: Improved code in 'mactime' to reduce warnings when
1533 '-w' is used with Perl ('exists' checks on arrays).
1534 08/27/03: Update: Improved code in 'sorter' to reduce warnings when
1535 '-w' is used with Perl (inode_int for NTFS).
1536
1537 ---------------- VERSION 1.64 --------------
1538 08/01/03: Docs Fix: The Sun VTOC was documented as Virtual TOC and it
1539 should be Volume TOC (Jake @ UMASS).
1540 08/02/03: Bug Fix: Some compilers complained about verbose logging
1541 assignment in 'mmls' (Ralf Spenneberg).
1542
1543 ---------------- VERSION 1.63 --------------
1544 06/13/03; Update: Added 'mmtools' directory with 'dos' partitions
1545 and 'mmls'.
1546 06/18/03: Update: Updated the documents in the 'doc' directory
1547 06/19/03: Update: Updated error message for EXT3FS magic check
1548 06/27/03: Update: Added slot & table number to mmls
1549 07/08/03: Update: Added mac support to mmtools
1550 07/11/03: Bug Fix: 'sorter' was not processing all unallocated meta
1551 data structures because of a regexp error. (reported by Jeff Reava)
1552 07/16/03: Update: Added support for FreeBSD5
1553 07/16/03: Update: Added BSD disk labels to mmtools
1554 07/28/03: Update: Relaxed requirements for DOS directory entries, the wtime
1555 can be zero (reported by Adam Uccello).
1556 07/30/03: Update: Added SUN VTOC to mmtools
1557 07/31/03: Update: Added NetBSD support (adam@monkeybyte.org)
1558 08/01/03: Update: Added more sanity checks to FAT so that it would not
1559 try and process NTFS images that have the same MAGIC value
1560
1561 ---------------- VERSION 1.62 --------------
1562 04/11/03: Bug Fix: 'fsstat' for an FFS file system could report data
1563 fragments in the last group that were larger than the maximum
1564 fragment
1565 04/11/03: Bug Fix: 'ffs' allows the image to not be a multiple of the
1566 block size. A read error occured when it tried to read the last
1567 fragments since a whole block could not be read.
1568 04/15/03: Update: Added debug statements to FAT code.
1569 04/26/03: Update: Added verbose statements to FAT code
1570 04/26/03: Update: Added NOABORT flag to dls -s
1571 04/26/03: Update: Added stderr messages for errors that are not aborted
1572 because of NOABORT
1573 05/27/03: Update: Added 'mask' field to FATFS_INFO structure and changed
1574 code in fatfs.c to use it.
1575 05/27/03: Update: isdentry now checks the starting cluster to see if
1576 it is a valid size.
1577 05/27/03: Bug Fix: Added a sanitizer to 'sorter' to remove invalid chars
1578 from the 'file' output and reduce the warnings from Perl.
1579 05/28/03: Bug Fix: Improved sanitize expression in 'sorter'
1580 05/28/03: Update: Added '-d' option to 'mactime' to allow output to be
1581 given in comma delimited format for importing into a spread sheet or
1582 other graphing tool
1583 06/09/03: Update: Added hourly summary / indexing to mactime
1584 06/09/03: Bug Fix: sorter would not allow linux-ext3 fstype
1585
1586
1587 ---------------- VERSION 1.61 --------------
1588 02/05/03: Update: Started addition of image thumbnails to sorter
1589 03/05/03: Update: Updated 'file' to version 3.41
1590 03/16/03: Update: Added comments and NULL check to 'ifind'
1591 03/16/03: Bug Fix: Added a valid magic of 0 for MFT entries. This was
1592 found in an XP image.
1593 03/26/03: Bug Fix: fls would crash for an inode of 0 and a clock skew
1594 was given. fixed the bug in fls.c (debug help from Josep Homs)
1595 03/26/03: Update: Added more verbose comments to ntfs_dent.c.
1596 03/26/03: Bug Fix: 'ifind' for a path could return a result that was
1597 shorter than the requested name (strncmp was used)
1598 03/26/03: Update: Short FAT names can be used in 'ifind -n' and
1599 error messages were improved
1600 03/26/03: Bug Fix: A final NTFS Index Buffer was not always processed in
1601 ntfs_dent.c, which resulted in files not being shown. This was fixed
1602 with debugging help from Matthew Shannon.
1603 03/27/03: Update: Added an 'index.html' for image thumbnails in sorter
1604 and added a 'details' link from the thumbnail to the images.html file
1605 03/27/03: Update: 'sorter' can now take a directory inode to start
1606 processing
1607 03/27/03: Update: added '-z' flag when running 'file' in 'sorter' so that
1608 compressed file contents are reported
1609 03/27/03: Update: added '-i' flag to 'mactime' that creates a daily
1610 summary of events
1611 03/27/03: Update: Added support for Version 2 of the NSRL in 'hfind'
1612 04/01/03: Update: Added support for Hash Keeper to 'hfind'
1613 04/01/03: Update: Added '-e' flag to 'hfind' for extended info
1614 (currently hashkeeper only)
1615
1616
1617 ---------------- VERSION 1.60 --------------
1618 10/31/02: Bug Fix: the unmounting status of EXT2FS in the 'fsstat' command
1619 was not correct (reported by Stephane Denis).
1620 11/24/02: Bug Fix: The -v argument was not allowed on istat or fls (Michael
1621 Stone)
1622 11/24/02: Bug Fix: When doing an 'ifind' on a UNIX fs, it could abort if it
1623 looked at an unallocated inode with invalid indirect block pointers.
1624 This was fixed by adding a "NOABORT" flag to the walk code and adding
1625 error checks in the file system code instead of relying on the fs_io
1626 code. (suggested by Micael Stone)
1627 11/26/02: Update: ifind has a '-n' argument that allows one to specify a
1628 file name it and it searches to find the meta data structure for it
1629 (suggested by William Salusky).
1630 11/26/02: Update: Now that there is a '-n' flag with 'ifind', the '-d'
1631 flag was added to specify the data unit address. The old syntax of
1632 giving the data_unit at the end is no longer supported.
1633 11/27/02: Update: Added sanity checks on meta data and data unit addresses
1634 earlier in the code.
1635 12/12/02: Update: Added additional debug statements to NTFS code
1636 12/19/02: Update: Moved 'hash' directory to 'hashtools'
1637 12/19/02: Update: Started development of 'hfind'
1638 12/31/02: Update: Improved verbose debug statements to show full 64-bit
1639 offsets
1640 01/02/03: Update: Finished development of 'hfind' with ability to update
1641 for next version of NSRL (which may have a different format)
1642 01/05/03: Bug Fix: FFS and EXT2FS symbolic link destinations where not
1643 properly NULL terminated and some extra chars were appended in 'fls'
1644 (later reported by Thorsten Zachmann)
1645 01/06/03: Bug Fix: getu64() was not properly masking byte sizes and some
1646 data was being lost. This caused incorrect times to be displayed in some
1647 NTFS files.
1648 01/06/03: Bug Fix: ifind reported incorrect ownership for some UNIX
1649 file systems if the end fragments were allocated to a different file than
1650 the first ones were.
1651 01/07/03: Update: Renamed the src/mactime directory to src/timeline.
1652 01/07/03: Update: Updated README and man pages for hfind and sorter
1653 01/12/03: Bug Fix: ntfs_mft_lookup was casting a 64-bit value to a 32-bit
1654 variable. This caused MFT Magic errors. Reported and debugged by
1655 Keven Murphy
1656 01/12/03: Update: Added verbose argument to 'fls'
1657 01/12/03: Bug Fix: '-V' argument to 'istat' was doing verbose instead of
1658 version
1659 01/13/03: Update: Changed static sizes of OFF_T and DADDR_T in Linux
1660 version to the actual 'off_t' and 'daddr_t' types
1661 01/23/03: Update: Changed use of strtok_r to strtok in ifind.c so that
1662 Mac 10.1 could compile (Dave Goldsmith).
1663 01/28/03: Update: Improved code in 'hfind' and 'sorter' to handle
1664 files with spaces in the path (Dave Goldsmith).
1665
1666 ---------------- VERSION 1.52 --------------
1667 09/24/02: Bug Fix: Memory leak in ntfs_dent_idxentry(), ntfs_find_file(),
1668 and ntfs_dent_walk()
1669 09/24/02: Update: Removal of index sequences for index buffers is now
1670 done using upd_off, which will allow for NTFS to move the structure in
1671 the future.
1672 09/26/02: Update: Added create time for NTFS / STANDARD_INFO to
1673 istat output.
1674 09/26/02: Update: Changed the method that the NTFS time is converted
1675 to UNIX time. Should be more effecient.
1676 10/09/02: Update: dcat error changed.
1677 10/02/02: Update: Includes a Beta version of 'sorter'
1678
1679
1680 ---------------- VERSION 1.51 --------------
1681 09/10/02: Bug Fix: Fixed a design bug that would not allow attribute
1682 lists in $MFT. This bug would generate an error that complained about
1683 an invalid MFT entry in attribute list.
1684 09/10/02: Update: The size of files and directories is now calculated
1685 after each time proc_attrseq() is called so that it is more up to date
1686 when dealing with attribute lists. The size has the sizes of all
1687 $Data, $IDX_ROOT, and $IDX_ALLOC streams.
1688 09/10/02: Update: The maxinum number of MFT entries is now calculated
1689 each time an MFT entry is processed while loading the MFT. This
1690 allows us to reflect what the maximum possible MFT entry is at that
1691 given point based on how many attribute lists have been processed.
1692 09/10/02: Update: Added file version 3.39 to distro (bigger magic files)
1693 (Salusky)
1694 09/10/02: Bug Fix: fs_data was wasting memory when it was allocated
1695 09/10/02: Update: added a fs_data_alloc() function
1696 09/12/02: Bug Fix: Do not give an error if an attribute list of an
1697 unallocated file points to an MFT that no longer claims it is a
1698 member of the list.
1699 09/12/02: Update: No longer need version to remove update sequence
1700 values from on-disk buffers
1701 09/19/02: Bug Fix: fixed memory leak in ntfs_load_ver()
1702 09/19/02: Bug Fix: Update sequence errors were displayed because of a
1703 bug that occured when an MFT entry crossed a run in $MFT. Only occured
1704 with 512-byte clusters and an odd number of clusters in a run.
1705 09/19/02: Update: New argument to ils, istat, and fls that allows user to
1706 specify a time skew in seconds of the compromised system. Originated
1707 from discussion at DFRWS II.
1708 09/19/02: Update: Added '-h' argument to mactime to display header info
1709
1710 ---------------- VERSION 1.50 --------------
1711
1712 04/21/02: icat now displays idxroot attribute for NTFS directories
1713 04/21/02: fs_dent_print functions now are passed the FS_DATA structure
1714 instead of the extra inode and name strings. (NTFS)
1715 04/21/02: fs_dent_print functions display alternate data stream size instead
1716 of the default data size (NTFS)
1717 04/24/02: Fixed bug in istat that displayed too many fragments with ffs images
1718 04/24/02: Fixed bug in istat that did not display sparse files correctly
1719 04/24/02: fsstat of FFS images now identifies the fragments at the
1720 beginning of cyl groups as data fragments.
1721 04/26/02: Fixed bug in ext2fs_dent_parse_block that did not advance the
1722 directory entry pointer far enough each time
1723 04/26/02: Fixed bug in ext2fs_dent_parse_block so that gave an error if
1724 a file name was exactly 255 chars
1725 04/29/02: Removed the getX functions from get.c as they are now macros
1726 05/11/02: Added support for lowercase flag in FAT
1727 05/11/02: Added support for sequence values (NTFS)
1728 05/13/02: Added FS_FLAG_META for FAT
1729 05/13/02: Changed ifind so that it looks the block up to identify if it is
1730 a meta data block when an inode can not be found
1731 05/13/02: Added a conditional to ifind so that it handles sparse files better
1732 05/19/02: Changed icat so that the default attribute type is set in the
1733 file_walk function
1734 05/20/02: ils and dls now use boundary inode & block values if too large
1735 or small are given
1736 05/21/02: istat now displays all NTFS times
1737 05/21/02: Created functions to just display date and time
1738 05/24/02: moved istat functionality to the specific file system file
1739 05/25/02: added linux-ext3 flag, but no new features
1740 05/25/02: Added sha1 (so Autopsy can use the NIST SW Database)
1741 05/26/02: Fixed bug with FAT that did not return all slack space on file_walk
1742 05/26/02: Added '-s' flag to dls to extract slack space of FAT and NTFS
1743 06/07/02: fixed _timezone variable so correct times are shown in CYGWIN
1744 06/11/02: *_copy_inode now sets the flags for the inode
1745 06/11/02: fixed bug in mactimes that displayed a duplicate entry with time
1746 because of header entries in body file
1747 06/12/02: Added ntfs.README doc
1748 06/16/02: Added a comment to file Makefile to make it easier to compile for
1749 an IR CD.
1750 06/18/02: Fixed NTFS bug that showed ADS when only deleted files were supposed
1751 to be shown (when ADS in directory)
1752 06/19/02: added the day of the week to the mactime output (Tan)
1753 07/09/02: Fixed bug that added extra chars to end of symlink destination
1754 07/17/02: 1.50 Released
1755
1756
1757
1758 ---------------- VERSION 1.00 --------------
1759 - Integrated TCT-1.09 and TCTUTILs-1.01
1760 - Fixed bug in bcat if size is not given with type of swap.
1761 - Added platform indep by including the structures of each file system type
1762 - Added flags for large file support under linux
1763 - blockcalc was off by 1 if calculated using the raw block number and
1764 not the one that lazarus spits out (which start at 1)
1765 - Changed the inode_walk and block_walk functions slightly to return a
1766 value so that a walk can be ended in the middle of it.
1767 - FAT support added
1768 - Improved ifind to better handle fragments
1769 - '-z' flag to fls and istat now use the time zone string instead of
1770 integer value.
1771 - no longer prepend / in _dent
1772 - verify that '-m' directory in fls ends with a '/'
1773 - identify the destination of sym links
1774 - fsstat tool added
1775 - fixed caching bug with FAT12 when the value overlapped cache entries
1776 - added mactime
1777 - removed the <inode> value in fls when printing mac format (inode is now printed in mactime)
1778 - renamed src/misc directory to src/hash (it only has md5 and will have sha)
1779 - renamed aux directory to misc (Windows doesn't allow aux as a name ??)
1780 - Added support for Cygwin
1781 - Use the flags in super block of EXT2FS to identify v1 or v2
1782 - removed file system types of linux1 and linux2 and linux
1783 - added file system type of linux-ext2 (as ext3 is becoming more popular)
1784 - bug in file command that reported seek error for object files and STDIN
Something went wrong with that request. Please try again.