Skip to content
Newer
Older
100644 1746 lines (1297 sloc) 70 KB
5668cd9 @bcarrier Updated NEWS.txt file with missing entries and changed format
bcarrier authored
1 Numbers refer to SourceForge.net tracker IDs:
2 http://sourceforge.net/tracker/?group_id=55685
1b20a34 @bcarrier fix for 2645156 that caused some FAT file slack to be missing in dls …
bcarrier authored
3
e8b3381 @bcarrier Merging in C++ classes and multithreaded support
bcarrier authored
4
5 ---------------- VERSION 3.3.0 --------------
6 New Features:
7 - Added multithreaded support
8 - Added C++ wrapper classes
9
5d53e05 @bcarrier resolved issues 3213886 and 3213888 re: RAW CD and not handling ISO96…
bcarrier authored
10 ---------------- VERSION 3.2.2 --------------
11 Bug Fixes
12 - 3213886: ISO9660 directory hole not advancing
bfd59e2 @bcarrier Added IMG_INFO openImage method to auto class
bcarrier authored
13 - 3173095 contd: Updated checks so that tougher FAT checks are
14 applied to deleted directories.
5d53e05 @bcarrier resolved issues 3213886 and 3213888 re: RAW CD and not handling ISO96…
bcarrier authored
15
16 New Features:
17 - 3213888: RAW CD format
bfd59e2 @bcarrier Added IMG_INFO openImage method to auto class
bcarrier authored
18 - Auto class accepts TSK_IMG_INFO as argument
5d53e05 @bcarrier resolved issues 3213886 and 3213888 re: RAW CD and not handling ISO96…
bcarrier authored
19
2cb22de @bcarrier fixed issue 3108272 regarding fls flags.
bcarrier authored
20 ---------------- VERSION 3.2.1 --------------
21 Bug Fixes
22 - 3108272: fls arguments for -d and -u
5855a5e @bcarrier 3105539: sqlite compile issues because pthread and ldl were needed
bcarrier authored
23 - 3105539: compile error issues because of SQlite and pthreads
05b721c @bcarrier resolved 3173095 re: files with invalid FAT dates now being shown
bcarrier authored
24 - 3173095: missing FAT files because of invalid dates.
0f13e76 @bcarrier part of issue 3184419 re: mingw compile errors
bcarrier authored
25 - 3184419: mingew compile errors.
330c409 @bcarrier issue 3191391 re: quotes in mactime csv output
bcarrier authored
26 - 3191391: surround file name in quotes in mactime -d csv output
6ea685c @bcarrier fix for 3043092 re: minor ifind logic issues
bcarrier authored
27
d530bcc @bcarrier added dummy entries to sqlite db if there is no volume system
bcarrier authored
28 New Features:
29 - A single dummy entry is added to the SQlite DB if no volume exists
30 so that all programs can assume that there will be at least one
31 volume in the table.
b6640d8 @bcarrier 3184455 re: builddir != srcdir
bcarrier authored
32 - 3184455: allow srcdir != builddir
d530bcc @bcarrier added dummy entries to sqlite db if there is no volume system
bcarrier authored
33
6ea685c @bcarrier fix for 3043092 re: minor ifind logic issues
bcarrier authored
34 ---------------- VERSION 3.2.0 --------------
35 Bug Fixes
36 - 3043092: Minor logic errors with ifind code.
7447626 @bcarrier minor bug fix in tsk_recover for file names in Unix
bcarrier authored
37 - FAT performance fix when looking for parent directories
38 in $OrphanFiles.
7eaa38c @bcarrier fixed issue 3052302 re: tsk_malloc trying to do a memset on data that…
bcarrier authored
39 - 3052302: Crash on NTFS/UFS detection test because of
40 corrupt data -- tsk_malloc error.
41e8227 @bcarrier patch for issue 3088447 regarding duplicate NTFS IDs
bcarrier authored
41 - 3088447: Error adding attribute because of run collision.
42 Solved by assigning unique IDs.
6ea685c @bcarrier fix for 3043092 re: minor ifind logic issues
bcarrier authored
43
9b5ee21 @bcarrier fix for 3012324 re: moving name mangling to outer layers and not in f…
bcarrier authored
44 New Features:
45 - 3012324: Name mangling moved out of library into outer tools
ad286b1 @bcarrier patch for 2993806 re: NONE value for ENUMs. Patch by Anthony Lawrence
bcarrier authored
46 so that they can see control characters if they want to. Patch
47 by Anthony Lawrence.
48 - 2993806: ENUM values have a specified NONE value if you don't
49 want to specify any special flags. Patch by Anthony Lawrence.
1036530 @bcarrier patch for 3026989 re: -e and -s flags to img_cat
bcarrier authored
50 - 3026989: Add -e and -s flags to img_cat. patch by Simson Garfinkel.
e24a2b6 @bcarrier patch 2941805 re: HFS case sensitive data by Rob Joyce.
bcarrier authored
51 - 2941805: Add case sensitive flag to fsstat in HFS. Patch by Rob Joyce.
a605ad0 @bcarrier patch for 3017764 re: not giving a fake name to NTFS attributes.
bcarrier authored
52 - 3017764: Changed how default NTFS $DATA attribute was named. Now it
53 has no name, while it previously had a fake name of "$Data".
41e8227 @bcarrier patch for issue 3088447 regarding duplicate NTFS IDs
bcarrier authored
54 - New TskAuto class.
55 - New tsk_loaddb, tsk_recover, tsk_comparedir, and tsk_gettimes tools.
9b5ee21 @bcarrier fix for 3012324 re: moving name mangling to outer layers and not in f…
bcarrier authored
56
1170040 @bcarrier resolved issue 3006733 re: slow directory listings because fs_dir_wal…
bcarrier authored
57 ---------------- VERSION 3.1.3 --------------
58 Bug Fixes
59 - 3006733: FAT directory listings were slow because the inner
60 code was not stopping when it found the parent directory.
044bb48 @bcarrier fixed fat checking errors in file name entries
bcarrier authored
61 - Adjusted sanity / testing code on FAT directory entries to allow
62 non-ascii in extensions and reject entries with lots of 0s.
7dad1e1 @bcarrier resolved issue 3023606 re: corrupt ext2 name
bcarrier authored
63 - 3023606: Ext2 / ffs corrupted file names.
57a0f78 @bcarrier applied NTFS SID patches from Mandiant
bcarrier authored
64 - Applied NTFS SID fixes from Mandiant.
4c3ffc8 @bcarrier applied ntfs_load_secure() memory leak from Michael Cohen.
bcarrier authored
65 - ntfs_load_secure() memory leak patch from Michael Cohen
1170040 @bcarrier resolved issue 3006733 re: slow directory listings because fs_dir_wal…
bcarrier authored
66
198bdd8 @bcarrier resolved issue 2982426 by not scanning entire image in search of pare…
bcarrier authored
67 ---------------- VERSION 3.1.2 --------------
68 Bug Fixes
69 - 2982426: FAT directory listings were slow because the entire
70 image was being scanned for parent directory information.
12d0417 @bcarrier applied patch 2982965 to fix attribute length values
bcarrier authored
71 - 2982965: fs_attr length bug fix.
9d09230 @bcarrier fixed issue 2988619 re: mmls -B display errors
bcarrier authored
72 - 2988619: mmls -B display error.
451e395 @bcarrier applied patch from 2988330 for NTFS SII processing
bcarrier authored
73 - 2988330: ntfs SII cluster size increment bug
5cac172 @bcarrier fixed issue 2991487 re: zeroed content in NTFS files that are not ful…
bcarrier authored
74 - 2991487: Zeroed content in NTFS files that were not fully intialized.
20ebf23 @bcarrier fix for 2993767 re: slow FAT directory listings because orphan files …
bcarrier authored
75 - 2993767: Slow FAT listings of OrphanFiles because hunt for parent
76 directory resulted in many searches for OrphanFiles. Added cache
77 of OrphanFiles.
92cb8e4 @bcarrier resolved issue 2999567 re: ifind not stopping after first hit
bcarrier authored
78 - 2999567: ifind was not stopping after first hit.
68dad51 @bcarrier resolved issue 2993804 re: not returning -1 on some reads past end of…
bcarrier authored
79 - 2993804: read past end of file did not always return -1.
198bdd8 @bcarrier resolved issue 2982426 by not scanning entire image in search of pare…
bcarrier authored
80
27e8fb2 @bcarrier fixed issue 2954703 re: missing file in ISO9660
bcarrier authored
81 ---------------- VERSION 3.1.1 --------------
82
83 Bug Fixes
84 - 2954703: ISO9660 missing files because duplicate files
85 had same starting block.
15acd4f @bcarrier forgot this in the previous update
bcarrier authored
86 - 2954707: ISO9660 missing some files with zero length and
87 duplicate starting block. Also changed behavior of how
88 multiple volume descriptors are processed.
f17c950 @bcarrier resolved issue 2955898 re: missing orphan files if no deleted file na…
bcarrier authored
89 - 2955898: Orphan files not found if no deleted file names exist.
8bd7e62 @bcarrier resolved issue 2955899 re: NTFS setting of USED flag.
bcarrier authored
90 - 2955899: NTFS internal setting of USED flag.
e536877 @bcarrier resolved issue 2972721 re: sorter not cleaning up MD5sum output that …
bcarrier authored
91 - 2972721: Sorter fails with hash lookup if '-l' is given.
c3adb4a @bcarrier resolved issue 2941813 re: incorrect internal HFS case sensitive flags
bcarrier authored
92 - 2941813: Reverse HFS case sensitive flags (internal fix only)
af60d07 @bcarrier fixed 2954448 re: Debian package typos and flags
bcarrier authored
93 - 2954448: Debian package typo fixes, etc.
951c215 @bcarrier resolved issue 2975245 re: sorter and realloc entries
bcarrier authored
94 - 2975245: sorter ignores realloc entries to reduce misleading mismatch entries and duplicate entries.
27e8fb2 @bcarrier fixed issue 2954703 re: missing file in ISO9660
bcarrier authored
95
96
5668cd9 @bcarrier Updated NEWS.txt file with missing entries and changed format
bcarrier authored
97 ---------------- VERSION 3.1.0 --------------
7956fd3 @bcarrier Applied patch from 2857258 for HFS flags
bcarrier authored
98
5668cd9 @bcarrier Updated NEWS.txt file with missing entries and changed format
bcarrier authored
99 New Features and Changes
100 - 2206285: HFS+ can now be read. Lots of tracker items about this.
101 Thanks to Rob Joyce and ATC-NY for many of the patches and reports.
102 - 2677069: DOS Safety Partitions in GPT Volume Systems are better
103 detected instead of reporting multiple VSs.
104 - Windows executables can be build in Visual Studio w/out needing
105 other image format libraries.
106 - 2367426: Uninitialized file space is shown if slack space is
107 requested.
108 - 2677107 All image formats supported by AFFLIB can be accessed by
109 specifying the "afflib" type.
110 - 2206265: sigfind can now process non-raw files.
111 - 2206331: Indirect block addresses are now available in the library
112 and command line tools. They are stored in a different attribute.
113 - Removed 'docs' files and moved them to the wiki.
114 - Removed disk_stat and disk_sreset because they were out of date
115 and hdparm now has the same functionality.
116 - 2874854: Image layer tools now support non-512 byte device sector
117 sizes. Users can specify sector size using the -b argument to the
118 command line tools. This has several consequences:
119 -- 'mmls -b' is now 'mmls -B'. Similarly with istat -b.
120 -- Changed command line format for '-o' so that sector size is
121 specified only via -b and not using '-o 62@4096'.
122 - 2874852: Sanity checking on partition table entires is relaxed
123 and only first couple of partitions are checked to make sure that
124 they can fit into the image.
125 - 2895607: NTFS SID data is available in the library and 'istat'.
126 - 2206341: AFF encrypted images now give more proper error message
127 if password is not given.
128 - 2351426: mactime is now distributed with Windows execs.
129
130
131 Developer-level Changes
132 - Abstracted name comparison to file system-specific function.
133 - Added support in mactime to read body files with comment lines.
134 - 2596153: Changed img_open arguments, similar to getopt().
135 - 2797169: tsk_fs_make_ls is now supported as an external library
136 function. Now named tsk_fs_meta_make_ls.
137 - 2908510: Nanosecond resolution of timestamps is now available.
138 - 2914255: Version info is now available in .h files in both string
139 and integer form.
140
141 Bug Fixes:
142 - 2568528: incorrect adjustment of attribute FILLER offset.
143 - 2596397: Incorrect date sorting in mactime.
144 - 2708195: Errors when doing long reads in fragmented attributes.
145 - Fixed typo bugs in sorter (reported via e-mail by Drew Hunt).
146 - 2734458: added orphan cache map to prevent slow NTFS listing times.
147 - 2655831: Sorter now knows about the ext2 and ext3 types.
148 - 2725799: ifind not converting UTF16 names properly on Windows
149 because it was using endian ordering of file system and not local
150 system.
151 - 2662168: warning messages on macs when reading the raw character
152 device.
153 - 2778170: incorrect read size on resident attributes.
154 - 2777633: missing second resolution on FAT creation times.
155 - Added the READ_SHARE option to the CreateFile command for split
156 image files. Patch by Christopher Siwy.
157 - 2786963: NTFS compression infinite loop fix.
158 - 2645156: FAT / blkls error getting slack because allocsize was
159 being set too small (and other values were not being reset).
160 - 2367426: Zeros are set for VDL slack on NTFS files.
161 - 2796945: Inifite loop in fs_attr.
162 - 2821031: Missing fls -m fields.
163 - 2840345: Extended DOS partitions in extended partitions are now
164 marked as Meta.
165 - 2848162: Reading attributes at offsets that are on boundary of
166 run fragment.
167 - 2824457: Fixed issue reading last block of file system with blkcat.
168 - 2891285: Fixed issue that prevented reads from the last block of
169 a file system when using the POSIX-style API.
170 - 2825690: Fixed issue that prevented blkls -A from working.
171 - 2901365: Allow FAT files to have a 0 wdate.
172 - 2900761: Added FAT directory sanity checks to prevent infinite loops.
173 - 2895607: Fixed various memory leaks.
174 - 2907248: Fixed image layer cache crash.
175 - 2905750: all file system read() functions now return -1 when
176 offset given is past end of file.
a30ae04 @bcarrier Addressed issue 2901365 re: missing FAT files by allowing wdate to be 0
bcarrier authored
177
64ba054 @bcarrier applied recurisve sanity checks for parent directory finding (issue 2…
bcarrier authored
178
4e466f1 @bcarrier Arranged CHANGES file to include 3.0.1 release
bcarrier authored
179 ---------------- VERSION 3.0.1 --------------
180 11/11/08: Bug Fix: Fixed crashing bug in ifind on FAT file system.
181 Bug: 2265927
182
183 11/11/08: Bug Fix: Fixed crashing bug in istat on ExtX $OrphanFiles
184 dir. Bug: 2266104
185
186 11/26/08: Update: Updated fls man page.
187
188 11/30/08: Update: Removed TODO file and using tracker for bugs and
189 feature requests.
190
191 12/29/08: Bug Fix: Fixed incorrectly setting block status in file_walk
192 for compressed files (Bug: 2475246)
193
194 12/29/08: Bug Fix: removed fs_info field from FS_META because it
195 was not being set and should have been removed in 3.0. Reported by
196 Rob Joyce and Judson Powers.
197
198 12/29/08: Bug Fix: orphan files and NTFS files found via parent
199 directory have an unknown file name type (instead of being equal
200 to meta type). (Bug: 2389901). Reported by Barry Grundy.
201
202 1/12/09: Bug Fix: Fixed ISO9660 bug where large directory contents
203 were not displayed. (Bug: 2503552). Reported by Tom Black.
204
205 1/24/09: Bug Fix: Fixed bug 2534449 where extra NTFS files were
206 shown if the MFT address was changed to 0 because fs_dir_add was
207 checking the address and name. Reported by Andy Bontoft.
208
209 1/29/09: Update: Fixed fix for bug 2534449. The fix is in ifind
210 instead of fs_dir_add().
211
212 2/2/09: Update: Added RPM spec file from Morgan Weetmam.
213
214
5d365e3 @bcarrier Removed fs_info from FS_META
bcarrier authored
215 ---------------- VERSION 3.0.0 --------------
3a78df5 @bcarrier initial import from CVS
bcarrier authored
216 0/00/00: Update: Many, many, many API changes.
217
218 2/14/08: Update: Added mmcat tool.
219
220 2/26/08: Update: Added flags to mmls to specify partition types.
221
222 3/1/08: Update: Major update of man pages.
223
224 4/14/08: Bug Fix: Fixed the calculation of "actual" last block.
225 Off by 1 error. Reported by steve.
226
227 5/23/08: Bug Fix: Incorrect malloc return check in srch_strings.
228 reported by Petri Latvala.
229
230 5/29/08: Bug Fix: Fixed endian ordering bug in ISO9660 code. Reported
231 by Eduardo Aguiar de Oliveira.
232
233 6/17/08: Update: 'sorter' now uses the ifind method for finding
234 deleted NTFS files (like Autopsy) does instead of relying on fls.
235 Reported by John Lehr.
236
237 6/17/08: Update: 'ifind -p' reports data on ADS.
238
239 7/10/08: Update: FAT looks for a backup boot sector in FAT32 if
240 magic is 0
241
242 7/21/08: Bug Fix: Changed define of strcasecmp to _stricmp instead
243 of _strnicmp in Windows. (reported by Darren Bilby).
244
245 7/21/08: Bug Fix: Fall back to open "\\.\" image files on Windows
246 with SHARE_WRITE access so that drive devices can be opened.
247 (reported by Darren Bilby).
248
249 8/20/08: Bug Fix: Look for Windows objects when opening files in
250 Cygwin, not just Win32. Reported by Par Osterberg Medina.
251
252 8/21/08: Update: Renamed library and install header files to have a '3'
253 in them to allow parallel installations of v2 and v3. Suggested by
254 Simson Garfinkel.
255
256 8/22/08: Update: Added -b option to sorter to specify minimum file size
257 to process. Suggested by Jeff Kell.
258
259 8/22/08: Update: Added libewf as a requirement to build win32 so that
260 E01 files are supported.
261
262 8/29/08: Update: Added initial mingw patches for cross compiling and
263 Windows. Patches by Michael Cohen.
264
265 9/X/08: Update: Added ability to access attibutes
266
267 9/6/08: Update: Added image layer cache.
268
269 9/12/08: Bug Fix: Fixed crash from incorrectly cleared value in FS_DIR
270 structure. Reported and patched by Jason Miller.
271
272 9/13/08: Update: Changed d* tool names to blk*.
273
274 9/17/08: Update: Finished mingw support so that both tools and
275 library work with Unicode file name support.
276
277 9/22/08: Update: Added new HFS+ code from Judson Powers and Rob Joyce (ATC-NY)
278
279 9/24/08: Bug Fix: Fixed some cygwin compile errors about types on Cygwin.
280 Reported by Phil Peacock.
281
282 9/25/08: Bug Fix: Added O_BINARY to open() in raw and split because Cygwin
283 was having problems. Reported by Mark Stam.
284
7561820 @bcarrier Added ifndef around TSK_USE_HFS
bcarrier authored
285 10/1/08: Update: Added ifndef to TSK_USE_HFS define to allow people
286 to define it on the command line. Patch by RB.
287
3a78df5 @bcarrier initial import from CVS
bcarrier authored
288
289 ---------------- VERSION 2.52 --------------
290 2/12/08: Bug Fix: Fixed warning messages in mactime about non-Numeric
291 data. Reported by Pope.
292
293 2/19/08: Bug Fix: Added #define to tsk_base_i.h to define
294 LARGEFILE64_SOURCE based on LARGEFILE_SOURCE for older Linux systems.
295
296 2/20/08: Bug Fix: Updated afflib references and code.
297
298 3/13/08: Update: Added more fixes to auto* so that AFF will compile
299 on more systems. I have confirmed that AFFLIB 3.1.3 will run with
300 OS X 10.4.11.
301
302 3/14/08: Bug Fix: Added checks to FAT code that calcs size of
303 directories. If starting cluster of deleted dir points into a
304 cluster chain, then problems can occur. Reported by John Ward.
305
306 3/19/08: Update: I have verified that this compiles with libewf-20070512.
307
308 3/21/08: Bug Fix: Deleted Ext/FFS directories were not being recursed
309 into. This case was rare (because typically the metadata are
310 wiped), but possible. Reported by JWalker.
311
312 3/24/08: Update: I have verified that this compiles with libewf-20080322.
313 Updates from Joachim Metz.
314
315 3/26/08: Update: Changed some of the header file design for the tools
316 so that the define settings in tsk_config.h can be used (for large files).
317
318 3/28/08: Update: Added config.h reference to srch_strings to get the
319 LARGEFILE support.
320
321 4/5/08: Update: Improved inode argument number parsing function.
322
323
324 ---------------- VERSION 2.51 --------------
325 1/30/08: Bug Fix: Fixed potential infinite loop in fls_lib.c. Patch
326 by Nathaniel Pierce.
327
328 2/7/08: Bug Fix: Defined some of the new constants that are used
329 in disktools because older Linux distros did not define them.
330 Reported by Russell Reynolds.
331
332 2/7/08: Bug Fix: Modified autoconf to check for large file build
333 requirements and look for new 48-bit structures needed by disktools.
334 Both of these were causing problems on older Linux distros.
335
336 2/7/08: Update: hfind will normalize hash values in database so
337 that they are case insensitive.
338
339 ---------------- VERSION 2.50 --------------
340 12/19/07: Update: Finished upgrade to autotools building design. No
341 longer include file, afflib, libewf. Resulted in many source code layout
342 changes and sorter now searches for md5, sha1, etc.
343
344 ---------------- VERSION 2.10 --------------
345 7/12/07: Update: 0s are returned for AFF pages that were not imaged.
346
347 7/31/07: Bug Fix: ifind -p could crash if a deleted file name was found
348 that did not point to a valid meta data stucture. (Reported by Andy Bontoft)
349
350 8/5/07: Update: Added NSRL support back into sorter.
351
352 8/15/07: Update: Errors are given if supplied sector offset is larger than
353 disk image. Reported by Simson Garfinkel.
354
355 8/16/07: Update: Renamed MD5 and SHA1 functions to TSK_MD5_.. and TSK_SHA_....
356
357 8/16/07: Update: tsk_error_get() does not reset the error messages.
358
359 9/26/07: Bug Fix: Changed FATFS check for valid dentries to consider
360 second values of 30. Reported by Alessandro Camillo.
361
362 10/18/07: Update: inode_walk for NTFS and FAT will not abort if
363 data corruption is found in one entry -- instead they will just
364 skip it.
365
366 10/18/07: Update: tsk_os.h uses standard gcc system names instead
367 of TSK specific ones.
368
369 10/18/07: Update: Updated raw.c to use ioctl commands on OS X to
370 get size of raw device because it does not work with SEEK_END.
371 Patch by Rob Joyce.
372
373 10/31/07: Update: Finished upgrade to fatfs_file_walk_off so that
374 walking can start at a specific offset. Also finished upgrade that
375 caches FAT run list to make the fatfs_file_walk_off more effecient.
376
377 11/14/07: Update: Fixed few places where off_t was being used
378 instead of OFF_T. Reported by GiHan Kim.
379
380 11/14/07: Update: Fixed a memory leak in aff.c to free AFF_INFO.
381 Reported by GiHan Kim.
382
383 11/24/07: Update: Finished review and update of ISO9660 code.
384
385 11/26/07: Bug Fix: Fixed 64-bit calculation in HFS+ code. Submitted
386 by Rob Joyce.
387
388 11/29/07: Update: removed linking of srch_strings.c and libtsk. Reported by
389 kwizart.
390
391 11/30/07: Upate: Made a #define TSK_USE_HFS compile flag for incorporating
392 the HFS support (flag is in src/fstools/fs_tools_i.h)
393
394 11/30/07: Update: restricted the FAT dentry sanity checks to verify
395 space padding in the name and latin-only extensions.
396
397 12/5/07: Bug Fix: fs_read_file_int had a bug that ignored the type passed
398 for NTFS files. Reported by Dave Collett.
399
400 12/12/07: Update: Changed teh FAT dentry sanity checks to allow spaces
401 in volume labels and do more checking on the attribute flag.
402
403
404
405
406 ---------------- VERSION 2.09 --------------
407 4/6/07: Bug Fix: Inifite loop in ext2 and ffs istat code because of using
408 unsigned size_t variable. Reported by Makoto Shiotsuki.
409
410 4/16/07: Bug Fix: Changed use of fseek() to fseeko() in hashtools. Patch
411 by Andy Bontoft.
412
413 4/16/07: Bug Fix: Changed Win32 SetFilePointer to use LARGE_INTEGER.
414 Reported by Kim GiHan.
415
416 4/19/07: Bug Fix: Not all FAT orphan files were being found because of
417 and offset error.
418
419 4/26/07: Bug Fix: ils -O was not working (link value not being
420 checked). Reported by Christian Perst.
421
422 4/27/07: Bug Fix: ils -r was showing UNUSED inodes. Reported by
423 Christian Perst.
424
425 5/10/07: Update: Redefined the USED and UNUSED flags for NTFS so that
426 UNUSED is set when no attributes exist.
427
428 5/16/07: Bug Fix: Fixed several bounds checking bugs that may cause
429 a crash if the disk image is corrupt. Reported by Tim Newsham (iSec
430 Partners)
431
432 5/17/07: Update: Updated AFFLIB to 2.2.11
433
434 5/17/07: Update: Updated libewf to libewf-20070512
435
436 5/17/07: Update: Updated file to 4.20
437
438 5/29/07: Update: Removed NTFS SID/SDS contributed code because it causes
439 crashes on some systems and its output is not entirely clear. (most recent bug
440 reported by Andy Scott)
441
442 6/11/07: Update: Updated AFFLIB to 2.2.12.
443
444 6/12/07: Bug Fix: ifind -p was not reporting back info on the allocated name
445 when one existed (because strtok was overwritting the name when the search
446 continued). Reported by Andy Bontoft.
447
448 6/13/07: Update: Updated file to 4.21
449
450
451 ---------------- VERSION 2.08 --------------
452 12/19/06: Bug Fix: ifind_path was not setting *result when root inode
453 was searched for. patch by David Collett.
454
455 12/29/06: Update: Removed 'strncpy' in ntfs.c to manual assignment of
456 text for '$Data' and 'N/A' for performance reasons.
457
458 1/11/07: Update: Added duname to FS_INFO that contains a string of
459 name for a file system's data unit -- Cluster for example.
460
461 1/19/07: Bug Fix: ifind_path was returning an error even after some
462 files were found. Errors are now ignored if a file was found.
463 Reported by Michael Cohen.
464
465 1/26/07: Bug Fix: Fixed calcuation of inode numbers in fatfs.c
466 (reported by Simson Garfinkel).
467
468 2/1/07: Update: Changed aff-install to support symlinked directory.
469
470 2/1/07: Update: img_open modified so that it does not report errors for
471 s3:// and http:// files that do not exist.
472
473 2/5/07: Update: updated *_read() return values to look for "<0" instead of
474 simply "== -1". (suggested by Simson Garfinkel).
475
476 2/8/07: Update: removed typedef for uintptr in WIN32 code.
477
478 2/13/07: Update: Applied patch from Kim Kulak to update HFS+ code to internal
479 design changes.
480
481 2/16/07: Update: Renamed many of the external data structures and flags
482 so that they start with TSK_ or tsk_ to prevent name collisions.
483
484 2/16/07: Update: Moved MD5 and SHA1 routines and binaries to auxtools
485 instead of hashtools so that they are more easy to access.
486
487 2/16/07: Update: started redesign and port of hashtools.
488
489 2/21/07: Update: Changed inode_walk callback API to remove the flags
490 variable -- this was redundant since flags are also in TSK_FS_INODE.
491 Same for TSK_FS_DENT.
492
493 3/7/07: Bug Fix: fs_read_file failed for NTFS resident files. Reported
494 by Michael Cohen.
495
496 3/8/07: Bug Fix: FATFS assumed a 512-byte sector in a couple of locations.
497
498 3/13/07: Update: Finished hashtools update.
499
500 3/13/07: Update: dcat reads block by block instead of all at once.
501
502 3/23/07: Update: Change ntfs_load_secure to allocate all of its
503 needed memory at once instead of doing reallocs.
504
505 3/23/07: Update: Updated AFFLIB to 2.2.0
506
507 3/24/07: Bug Fix: Fixed many locations where return value from strtoull
508 was not being properly checked and therefore invalid numbers were not
509 being detected.
510
511 3/24/07: Bug Fix: A couple of error messages in ntfs_file_walk should
512 have been converted to _RECOVER when the _RECOVERY flag was given.
513
514 3/24/07: Update: Changed behavior of ntfs_file_walk. If no type is
515 given, then a default type is chosen for files and dirs. Now, no error
516 is generated if that type does not exist -- similar to how no error is
517 generated if a FAT file has 0 file size.
518
519 3/26/07: Update: cleaned up and documented fs_data code more.
520
521 3/29/07: Update: Updated AFF to 2.2.2.
522
523 3/29/07: Update: Updated install scripts for afflib, libewf, and file to
524 touch files so that the auto* files are in the correct time stamp order.
525
526 4/5/07: Bug Fix: Added sanity checks to offsets and addresses in ExtX and
527 UFS group descriptors. Reported by Simson Garfinkel.
528
529
530 ---------------- VERSION 2.07 --------------
531 9/6/06: Update: Changed TCHAR and _T to TSK_TCHAR and _TSK_T to avoid
532 conflicts with other libraries.
533
534 9/18/06: Update: Added tsk_list_* functions and strutures.
535
536 9/18/06: Update: Added checks for recursive FAT directories.
537
538 9/20/06: Update: Changed FS_META_* flags for LINK and UNLINK and moved
539 them to ILS_? flags.
540
541 9/20/06: Update: added flags to ils to find only orphan inodes.
542
543 9/20/06: Update: Added Orphan support for FAT, NTFS, UFS, Ext2, ISO.
544
545 9/20/06: Update: File walk actions now have a flag to identify if a block
546 is SPARSE or not (used to identify if the address being passed is valid
547 or made up).
548
549 9/21/06: Update: Added file size sanity check to fatfs_is_dentry and
550 fixed assignment of fatfs->clustcnt.
551
552 9/21/06: Update: block_, inode, and dent_walk functions now do more flag
553 checking and make sure that some things are set instead of making the
554 calling code do it.
555
556 9/21/06: Update: Added checks for recursive (infinite loop) NTFS, UFS,
557 ExtX, and ISO9660 directories.
558
559 9/21/06: Update Added checks to make sure that walking the FAT for files
560 and directories would result in an infinite loop (if FAT is corrupt).
561
562 9/21/06: Update: Added -a and -A to dls to specify allocated and
563 unallocated blocks to display.
564
565 9/21/06: Update: Updated AFFLIB to 1.6.31.
566
567 9/22/06: Update: added a fs_read_file() function that allows you to read
568 random parts of a file.
569
570 10/10/06: Update: Improved performance of fs_read_file() and added
571 new FS_FLAG_META_COMP and FS_FLAG_DATA_COMP flags to show if a file
572 and data are using file system-level compression (NTFS only).
573
574 10/18/06: Bug fix: in fs_data_put_run, added a check to see
575 if the head was null before looking up. An extra error message
576 was being created for nothing.
577
578 10/18/06: Bug Fix: Added a check to the compression buffer
579 to see if it is null in _done().
580
581 10/25/06: Bug Fix: Added some more bounds checks to NTFS uncompression code.
582
583 11/3/06: Bug Fix: added check to dcat_lib in case the number of blocks
584 requested is too large.
585
586 11/07/06: Update: Added fs_read_file_noid wrapper around fs_read_file
587 interface.
588
589 11/09/06: Update: Updated AFF to 1.7.1
590
591 11/17/06: Update: Updated libewf to 20061008-1
592
593 11/17/06: Bug Fix: Fixed attribute lookup bug in fs_data_lookup.
594 Patch by David Collett.
595
596 11/21/06: Bug Fix: Fixed fs_data loops that were stopping when they hit
597 an unused attribute. Patch by David Collett.
598
599 11/21/06: Bug Fix: sorter no longer clears the path when it starts. THis
600 was causing errors on Cygwin because OpenSSL libraries could not be found.
601
602 11/22/06: Update: Added a tskGetVersion() function to return the string
603 of the current version.
604
605 11/29/06: Update: Added more tsk_error_resets to more places to prevent
606 extra error messages from being displayed.
607
608 11/30/06: Update: Added Caching to the getFAT function and to fs_read.
609
610 12/1/06: Update: Changed TSK_LIST to a reverse sorted list of buckets.
611
612 12/5/06: Bug Fix: Fixed FS_DATA_INUSE infinite loop bug.
613
614 12/5/06: Bug Fix: Fixed infinite loop bug with NTFS decompression code.
615
616 12/5/06: Update: Added NULL check to fs_inode_free (from Michael Cohen).
617
618 12/5/06: Update: Updated ifind_path so that an allocated name will be
619 shown if one exists -- do not exit if we find simply an unallocated
620 entry with an address of 0. Suggested by David Collett.
621
622 12/6/06: Update: Updated file to version 4.18.
623
624 12/6/06: Update: Updated libaff to 2.0a10 and changed build process
625 accordingly.
626
627 12/7/06: Update: Added a tsk_error_get() function that returns a string
628 with the error messages -- can be used instead of tsk_error_print.
629
630 12/7/06: Update: fixed some memory leaks in FAT and NTFS code.
631
632 12/11/06: Bug Fix: fatfs_open error message code referenced a value that
633 was in freed memory -- reordered statements.
634
635 12/15/06: Update: Include VCProj files in build.
636
637
638 ---------------- VERSION 2.06 --------------
639 8/11/06: Bug Fix: Added back in ASCII/UTF-8 checks to remove control
640 characters in file names.
641
642 8/11/06: Bug Fix: Added support for fast sym links in UFS1
643
644 8/11/06: Update: Redesigned the endian support so that getuX takes only
645 the endian flag so that the Unicode design could be changed as well.
646
647 8/11/06: Update: Redesigned the Unicode support so that there is a
648 tsk_UTF... routine instead of fs_UTF...
649
650 8/11/06: Update: Updated GPT to fully convert UTF16 to UTF8.
651
652 8/11/06: Update: There is now only one aux_tools header file to include
653 instead of libauxtools and/or aux_lib, which were nearly identical.
654
655 8/16/06: Bug Fix: ntfs_dent_walk could segfault if two consecutive
656 unallocated entries were found that had an MFT entry address of 0.
657 Reported by Robert-Jan Mora.
658
659 8/16/06: Update: Changed a lot of the header files and reduced them so
660 that it is easier to use the library and only one header file needs to
661 be included.
662
663 8/21/06: Update: mmtools had char * instead of void * for walk callback
664
665 8/22/06: Update: Added fs_load_file function that returns a buffer full
666 with the contents of a file.
667
668 8/23/06: Update: Upgraded AFFLIB to 1.6.31 and libewf to 20060820-1.
669
670 8/25/06: Update: Created printf wrappers so that output is UTF-16 on
671 Windows and UTF-8 on Unix.
672
673 8/25/06: Update: Continued port to Windows by starting to use more
674 TCHARS and defining needed macros for the Unix side.
675
676 8/25/06: Bug Fix: Fixed crash that could occur because of SDS code
677 in NTFS. (reported by Simson Garfinkel) (BUG: 1546925).
678
679 8/25/06: Bug Fix: Fixed crash that could occur because path stack became
680 corrupt with deep directories or corrupt images. (reported by Simson
681 Garfinkel) (BUG: 1546926).
682
683 8/25/06: Bug Fix: Fixed infinite loop that could occur when trying to
684 determine size of FAT directory when the FAT has a loop in it. (BUG:
685 1546929)
686
687 8/25/06: Update: Improved FAT checking code to look for '.' and '..'
688 entries when inode value is replaced during dent_walk.
689
690 8/29/06: Update: Finished Win32 port and changes to handle UTF-16 vs
691 UTF-8 inputs.
692
693 8/29/06: Update: Created a parse_inum function to handle parsing inode
694 addresses from command line.
695
696 8/30/06: Update: Made progname a local variable instead of global.
697
698 8/31/06: Bug Fix: Fixed a sizeof() error with the memset in fatfs_inode_walk
699 for the sect_alloc buffer.
700
701 8/31/06: Update: if mktime in dos2unixtime returns any negative value,
702 then the return value is set to 0. Windows and glibc seem to have
703 different return values.
704
705 ---------------- VERSION 2.05 --------------
706 5/15/06: Bug Fix: Fixed a bug in img_cat that could cause it to
707 go into an infinite loop. (BUG: 1489284)
708
709 5/16/06: Update: Fixed printf statements in tsk_error.c that caused
710 warning messages for some compilers. Reported by Jason DePriest.
711
712 5/17/06: Update: created a union of file system-specific file times in
713 FS_INFO (Patch by Wyatt Banks)
714
715 5/22/06: Bug Fix: Updated libewf to 20060520 to fix bug with reported
716 image size. (BUG: 1489287)
717
718 5/22/06: Bug Fix: Updated AFFLIB to 1.6.24 so that TSK could compile in
719 CYGWIN. (BUG: 1493013)
720
721 5/22/06: Update: Fixed some more printf statements that were causing
722 compile warnings.
723
724 5/23/06: Update: Added a file existence check to img_open to make error
725 message more accurate.
726
727 5/23/06: Update: Usage messages had extra "Supported image types message".
728
729 5/25/06: Update: Added block / page range to fsstat for raw and swapfs.
730
731 6/5/06: Update: fixed some typos in the output messages of sigfind (reported
732 by Jelle Smet)
733
734 6/9/06: Update: Added HFS+ template to sigfind (Patch by Wyatt Banks)
735
736 6/9/06: Update: Added ntfs and HFS template to sigfind.
737
738 6/19/06: Update: Begin Windows Visual Studio port
739
740 6/22/06: Update: Updated a myflags check in ntfs.c (reported by Wyatt Banks)
741
742 6/28/06: Update: Incorporated NTFS compression patch from I.D.E.A.L.
743
744 6/28/06: Update: Incorporated NTFS SID patch from I.D.E.A.L.
745
746 6/28/06: Bug Fix: A segfault could occur with NTFS if no inode was loaded
747 in the dent_walk code. (Reported by Pope).
748
749 7/5/06: Update: Added tsk_error_reset function and updated code to use it.
750
751 7/5/06: Update: Added more sanity checks to the DOS partitions code.
752
753 7/10/06: Update: Upgraded libewf to version 20060708.
754
755 7/10/06: Update: Upgraded AFFLIB to version 1.6.28
756
757 7/10/06: Update: added 'list' option to usage message so that file
758 system, image, volume system types are listed only if '-x list' is given.
759 Suggested by kenshin.
760
761 7/10/06: Update: Compressed NTFS files use the compression unit size
762 specified in the header.
763
764 7/10/06: Update: Added -R flag to icat to suppress recovery warnings and
765 use this flag in sorter to prevent FAT recovery messages from filling
766 up screen.
767
768 7/10/06: Update: file_walk functions now return FS_ERR_RECOVERY error
769 codes for most cases if the RECOVERY flag is set -- this allows the
770 errors to be more easily suppressed.
771
772 7/12/06: Update: Removed individual libraries and now make a single
773 static libtsk.a library.
774
775 7/12/06: Update: Cleaned up top-level Makefile. Use '-C' flag (suggested
776 by kenshin).
777
778 7/14/06: Update: Fixed and redesigned some of the new NTFS compression
779 code. Changed variable names.
780
781 7/20/06: Update: Fixed an NTFS compression bug if a sub-block was not
782 compressed.
783
784 7/21/06: Update: Made NTFS compression code thread friendly.
785
786
787 ---------------- VERSION 2.04 --------------
788 12/1/05: Bug Fix: Fixed a bug in the verbose output of img_open
789 that would crash if no type or offset was given. Reported and
790 patched by Wyatt Banks.
791
792 12/20/05: Bug Fix: An NTFS directory index sanity check used 356
793 instead of 365 when calculating an upper bound on the times. Reported
794 by Wyatt Banks.
795
796 12/23/05: Bug Fix: Two printf statements in istat for NTFS printed
797 to stdout instead of a specific file handle. Reported by Wyatt
798 Banks.
799
800 1/22/06: Bug Fix: fsstat, imgstat and dcalc were using a char instead
801 of int for the return value of getopt, which caused some systems to not
802 execute the programs. (internal fix and later reported by Bernhard Reiter)
803
804 2/23/06: Update: added support for FreeBSD 6.
805
806 2/27/06: Bug Fix: Indirect blocks would nto be found by ifind with
807 UFS and Ext2. Reported by Nelson G. Mejias-Diaz. (BUG: 1440075)
808
809 3/9/06: Update: Added AFF image file support.
810
811 3/14/06: Bug Fix: If the first directory entry of a UFS or ExtX block
812 was unallocated, then later entries may not be shown. Reported by John
813 Langezaal. (BUG: 1449655)
814
815 4/3/06: Update: Finished the improved error handling. Many internal
816 changes, not many external changes. error() function no longer used
817 and instead tsk_err variables and function are used. This makes the
818 library more powerful.
819
820 4/5/06: Update: The byte offset for a volume is now passed to the mm_
821 and fs_ functions instead of img_open. This allows img_info to be used
822 for multiple volumes at the same time. This required some mm_ changes.
823
824 4/5/06: Update: All TSK libraries are written to the lib directory.
825
826 4/6/06: Update: Added FS_FLAG_DATA_RES flag to identify data that are
827 resident in ntfs_data_walk (suggested by Michael Cohen).
828
829 4/6/06: Update: The partition code (media Management) now checks that a
830 partition starts before the end of the image file. There are currently
831 no checks about the end of the partition though.
832
833 4/6/06: Update: The media management code now shows unpartitioned space
834 as such from the end of the last partition to the end of the image file
835 (using the image file size). (Suggested by Wyatt Banks).
836
837 4/7/06: Update: New version of ISO9660 code from Wyatt Banks and Crucial
838 Security added and other code updated to allow CDs to be analyzed.
839
840 4/7/06: There was a conflict with guessuXX with mmtools and fstools.
841 Renamed to mm_guessXX and fs_guessXX.
842
843 4/10/06: Upgraded AFFLIB to 1.5.6
844
845 4/12/06: Added version of libewf and support for it in imgtools
846
847 4/13/06: Added new img_cat tool to extract raw data from an image format.
848
849 4/24/06: Upgraded AFFLIB to 1.5.12
850
851 4/24/06: split and raw check if the image is a directory
852
853 4/24/06: Updated libewf to 20060423-1
854
855 4/26/06: Updated makedefs to work with SunOS 5.10
856
857 5/3/06: Added iso9660 patch from Wyatt Banks so that version number
858 is not printed with file name.
859
860 5/4/06: Updated error checking in icat, istat, fatfs_dent, and ntfs_dent
861
862 5/8/06: Updated libewf to 20060505-1 to fix some gcc 2 compile errors.
863
864 5/9/06: Updated AFFLIB to 1.6.18
865
866 5/11/06: Cleaned up error handling (removed %m and unused legacy code)
867
868 5/11/06: Updated AFFLIB to 1.6.23
869
870 ---------------- VERSION 2.03 --------------
871 7/26/05: Update: Removed incorrect print_version() statement from
872 fs_tools.h (reported by Jaime Chang)
873
874 7/26/05: Update: Renamed libraries to start with "lib"
875
876 7/26/05: Update: Removed the logfp variable for verbose statements
877 and instead use only stderr.
878
879 8/12/05: Update: If time is 0, then it is put as 00:00:00 instead of
880 the default 1970 or 1980 time.
881
882 8/13/05: Update: Added Unicode support for FAT and NTFS (Supported by
883 I.D.E.A.L. Technology Corp).
884
885 9/2/05: Update: Added Unicode support for UFS and ExtX. Non-printable
886 ASCII characters are no longer replaced with '^.'.
887
888 9/2/05: Update: Improved the directory entry sanity checks for UFS
889 and ExtX.
890
891 9/2/05: Update: Upgraded file to version 4.15.
892
893 9/2/05: Update: The dent_walk code of all file systems does not
894 abort if a sub-directory is encountered with an error. If it is the
895 top directory explicitly called, then it still gives an error.
896
897 9/2/05: Bug Fix: MD5 and SHA-1 values were incorrect under AMD64
898 systems because the incorrect variable sizes were being used.
899 (reported by: Regis Friend Cassidy. BUG: 1280966)
900
901 9/2/05: Update: Changed all licenses in TSK to Common Public License
902 (except those that were already IBM Public License).
903
904 9/15/05: Bug Fix: The Unicode names would not be displayed if the FAT
905 short name entry was using code pages. The ASCII name check was removed,
906 which may lead to more false positives during inode_walk.
907
908 10/05/05: Update: improved the sector size check when the FAT boot
909 sector is read (check for specific values besides just mod 512).
910
911 10/12/05: Update: The ASCII name check was added back into FAT, but
912 the check no longer looks for values over 0x80.
913
914 10/12/05: Update: The inode_walk function in FAT skips clusters
915 that are allocated to files. This makes it much faster, but it
916 will now not find unallocated directory entries in the slack space
917 of allocated files.
918
919 10/13/05: Update: sorter updated to handle unicode in HTML output.
920
921 ---------------- VERSION 2.02 --------------
922 4/27/05: Bug Fix: the sizes of 'id' were not consistent in the
923 front-end and library functions for icat and ffind. Reported by
924 John Ward.
925
926 5/16/05: Bug Fix: fls could segfault in FAT if short name did not
927 exist. There was also a bug where the long file name variable
928 (fatfs->lfn_len) was not reset after processing a directory and the
929 next entry could incorrectly get the long name. Reported by Jaime
930 Chang. BUG: 1203673.
931
932 5/18/05: Update: Updated makedefs to support Darwin 8 (OS X Tiger)
933
934 5/23/05: Bug Fix: ntfs_dent_walk would not always stop when WALK_STOP
935 was returned. This caused some issues with previous versions of ifind.
936 This was fixed.
937
938 5/24/05: Bug Fix: Would not compile under Suse because it had header
939 file conflicts for the size of int64_t. Reported by: Andrea Ghirardini.
940 BUG: 1203676
941
942 5/25/05: Update: Fixed some memory leaks in fstools (reported by Jaime
943 Chang).
944
945 6/13/05: Update: Compiled with g++ to get better warning messages.
946 Fixed many signed versus unsigned comparisons, -1 assignments to
947 unsigned vars, and some other minor internal issues.
948
949 6/13/05: Bug Fix: if UFS or FFS found a valid dentry in unallocated
950 space, it could have a documented length that is larger than the
951 remaining unallocated space. This would cause an allocated name
952 to be skipped. BUG: 1210204 Reported by Christopher Betz.
953
954 6/13/05: Update: Improved design of all dent code so that there are no
955 more global variables.
956
957 6/13/05: Update: Improved design of FAT dent code so that FATFS_INFO
958 does not keep track of long file name information.
959
960 6/13/05: Bug Fix: If a cluster in a directory started with a strange
961 dentry, then FAT inode_walk would skip it. The fixis to make sure
962 that all directory sectors are processed. (BUG: 1203669). Reported
963 by Jaime Chang.
964
965 6/14/05: Update: Changed design of FS_INODE so that it contains the
966 inode address and the inode_walk action was changed to remove inum
967 as an argument.
968
969 6/15/05: Update: Added 'ils -o' back in as 'ils -O' to list open
970 and deleted files.
971
972 6/15/05: Update: Added '-m' flag to mactime so that it prints the month
973 as a number instead of its name.
974
975 7/2/05: Bug Fix: If an NTFS file did not have a $DATA or $IDX_*
976 attribute, then fls would not print it. The file had no content, but
977 the name should be shown. (BUG: 1231515) (Reported by Fuerst)
978
979
980 ---------------- VERSION 2.01 --------------
981 3/24/05: Bug Fix: ffind would fail if the directory had two
982 non-printable chars. The handling of non-printable chars was changed
983 to replace with '^.'. (BUG: 1170310) (reported by Brian Baskin)
984
985 3/24/05: Bug Fix: icat would not print the output to stdout when split
986 images were used. There was a bug in the image closing process of
987 icat. (BUG: 1170309) (reported by Brian Baskin)
988
989 3/24/05: Update: Changed the header files in fstools to make fs_lib.h
990 more self contained.
991
992 4/1/05: Bug Fix: Imgtools byte offset with many leading 0s could
993 cause issues. (BUG: 1174977)
994
995 4/1/05: Update: Removed test check in mmtools/dos.c for value cluster
996 size because to many partition tables have that as a valid field.
997 Now it checks only OEM name.
998
999 4/8/05: Update: Updated usage of 'strtoul' to 'strtoull' for blocks
1000 and inodes.
1001
1002 ---------------- VERSION 2.00 --------------
1003 1/6/05: Update: Added '-b' flag to 'mmls' so that sizes can be
1004 printed in bytes. Suggested and a patch proposed by Matt Kucenski
1005
1006 1/6/05: Update: Define DADDR_T, INUM_T, OFF_T, PNUM_T as a static
1007 size and use those to store values in data structures. Updated
1008 print statements as well.
1009
1010 1/6/05: Update: FAT now supports larger images becuase the inode
1011 address space is 64-bits.
1012
1013 1/6/05: Moved guess and get functions to misc from mmtools and
1014 fstools.
1015
1016 1/7/05: Update: Added imgtools with support for "raw" and "split"
1017 layers. All fstools have been updated.
1018
1019 1/7/05: Update: removed dtime from ils output
1020
1021 1/9/05: Update: FAT code reads in clusters instead of sectors to
1022 be faster (suggested by David Collett)
1023
1024 1/9/05: Update: mmtools uses imgtools for split images etc.
1025
1026 1/10/05: Update: Removed usage of global variables when using
1027 file_walk internally.
1028
1029 1/10/05: Update: mmls BSD will use the next sector automatically
1030 if the wrong is given instead of giving an error.
1031
1032 1/10/05: Update: Updated file to version 4.12
1033
1034 1/11/05: Update: Added autodetect to file system tools.
1035
1036 1/11/05: Update: Changed names to specify file system type (not
1037 OS-based)
1038
1039 1/11/05: Update: Added '-t' option to fsstat to give just the type.
1040
1041 1/11/05: Update: Added autodetect to mmls
1042
1043 1/17/05: Update: Added the 'mmstat' tool that gives the type of
1044 volume system.
1045
1046 1/17/05: Update: Now using CVS for local version control - added
1047 date stamps to all files.
1048
1049 2/20/05: Bug Fix: ils / istat would go into an infinte loop if the
1050 attribute list had an entry with a length of 0. Reported by Angus
1051 Marshall (BUG: 1144846)
1052
1053 3/2/05: Update: non-printable letters in ExtX/UFS file names are
1054 now replaced by a '.'
1055
1056 3/2/05: Update: Made file system tools more library friendly by
1057 making stubs for each application.
1058
1059 3/4/05: Update: Redesigned the diskstat tool and created the
1060 disksreset tool to remove the HPA temporarily.
1061
1062 3/4/05: Update: Added imgstat tool that displays image format
1063 details
1064
1065 3/7/05: Bug Fix: In fsstat on ExtX, the final group would have an
1066 incorrect _percentage_ of free blocks value (although the actual
1067 number was correct). Reported by Knut Eckstein. (BUG: 1158620)
1068
1069 3/11/05: Update: Renamed diskstat, disksreset, sstrings, and imgstat to
1070 disk_stat, disk_sreset, srch_strings, and img_stat to make the names more
1071 clear.
1072
1073 3/13/05: Bug Fix: The verbose output for fatfs_file_walk had an
1074 incorrect sector address. Reported by Rudolph Pereira.
1075
1076 3/13/05: Bug Fix: The beta version had compiling problems on FreeBSD
1077 because of a naming clash with the new 'fls' functions. (reported
1078 by secman)
1079
1080
1081
1082 ---------------- VERSION 1.74 --------------
1083 11/18/04: Bug Fix: FreeBSD 5 would produce incorrect 'icat' output for
1084 Ext2/3 & UFS1 images because it used a 64-bit on-disk address.
1085 reported by neutrino neutrino. (BUG: 1068771)
1086
1087 11/30/04: Bug Fix: The makefile in disktools would generate an error
1088 on some systems (Cygwin) because of an extra entry. Reported by
1089 Vajira Ganepola (BUG: 1076029)
1090
1091
1092 ---------------- VERSION 1.73 --------------
1093 09/09/04: Update: Added journal support for EXT3FS and added jls
1094 and jcat tools.
1095
1096 09/13/04: Updated: Added the major and minor device numbers to
1097 EXTxFS istat.
1098
1099 09/13/04: Update: Added EXTxFS orphan code to 'fsstat'
1100
1101 09/24/04: Update: Fixed incorrect usage of 'ptr' and "" in action
1102 of ntfs_dent.c. Did not affect any code, but could have in the
1103 future. Reported by Pete Winkler.
1104
1105 09/25/04: Update: Added UFS flags to fsstat
1106
1107 09/26/04: Update: All fragments are printed for indirect block pointer
1108 addresses in UFS istat.
1109
1110 09/29/04: Update: Print extended UFS2 attributes in 'istat'
1111
1112 10/07/04: Bug Fix: Changed usage of (int) to (uintptr_t) for pointer
1113 arithmetic. Caused issues with Debian Sarge. (BUG: 1049352) - turned out
1114 to be from changes made to package version so that it would compile in
1115 64-bit system (BUG: 928278).
1116
1117 10/11/04: Update: Added diskstat to check for HPA on linux systems.
1118
1119 10/13/04: Update: Added root directory location to FAT32 fsstat output
1120
1121 10/17/04: Bug Fix: EXTxFS superblock location would not be printed
1122 for images in fsstat that did not have sparse superblok (which is
1123 rare) (BUG: 1049355)
1124
1125 10/17/04: Update: Added sigfind tool to find binary signatures.
1126
1127 10/27/04: Bug Fix: NTFS is_clust_alloc returned an error when loading
1128 $MFT that had attribute list entry. Now I assume that clusters
1129 referred to by the $MFT are allocated until the $MFT is loaded.
1130 (BUG: 1055862).
1131
1132 10/28/04: Bug Fix: Check to see if an attribute with the same name
1133 exists instead of relying on id only. (ntfs_proc_attrseq) Affects
1134 the processing of attribute lists. Reported by Szakacsits Szabolcs,
1135 Matt Kucenski, & Gene Meltser (BUG: 1055862)
1136
1137 10/28/04: Update: Removed usage of mylseek in fstools for all systems
1138 (Bug: 928278)
1139
1140
1141 ---------------- VERSION 1.72 --------------
1142 07/31/04: Update: Added flag to mft_lookup so that ifind can run in noabort
1143 mode and it will not stop when it finds an invalid magic value.
1144
1145 08/01/04: Update: Removed previous change and removed MAGIC check
1146 entirely. XP doesn't even care if the Magic is corrupt, so neither
1147 does TSK. The update sequence check should find an invalid MFT
1148 entry.
1149
1150 08/01/04: Update: Added error message to 'ifind' if none of the search
1151 options are given.
1152
1153 08/05/04: Bug Fix: Fixed g_curdirptr recursive error by clearing the value
1154 when dent_walk had to abort because a deleted directory could not be recovered.
1155 (BUG: 1004329) Reported by epsilon@yahoo.com
1156
1157 08/16/04: Update: Added a sanity check to fatfs.c fat2unixtime to check
1158 if the year is > 137 (which is the overflow date for the 32-bit UNIX time).
1159
1160 08/16/04: Update: Added first version of sstrings from binutils-2.15
1161
1162 08/20/04: Bug Fix: Fixed a bug where the group number for block 0 of an
1163 EXT2FS file system would report -1. 'dstat' no longer displays value when it
1164 is not part of a block group. (BUG: 1013227)
1165
1166 8/24/04: Update: If an attribute list entry is found with an invalid MFT
1167 entry address, then it is ignored instead of an error being generated and
1168 exiting.
1169
1170 8/26/04: Update: Changed internal design of NTFS to make is_clust_alloc
1171
1172 8/26/04: Update: If an attribute list entry is found with an invalid MFT
1173 entry address AND the entry is unallocated, then no error message is
1174 printed, it is just ignored or logged in verbose mode.
1175
1176 8/29/04: Update: Added support for 32-bit GID and UID in EXTxFS
1177
1178 8/30/04: Bug Fix: ntfs_dent_walk was adding 24 extra bytes to the
1179 size of the index record for the final record processing (calc of
1180 list_len) (BUG: 1019321) (reported and debugging help from Matt
1181 Kucenski).
1182
1183 8/30/04: Bug Fix: fs_data_lookup was using an id of 0 as a wild
1184 card, but 0 is a legit id value and this could cause confusion. To
1185 solve this, a new FS_FLAG_FILE_NOID flag was added and a new
1186 fs_data_lookup_noid function that will not use the id to lookup
1187 values. (BUG: 1019690) (reported and debugging help from Matt
1188 Kucenski)
1189
1190 8/30/04: Update: modified fs_data_lookup_noid to return unamed data
1191 attribute if that type is requested (instead of just relying on id
1192 value in attributes)
1193
1194 8/31/04: Update: Updated file to v4.10, which seems to fix the
1195 CYGWIN compile problem.
1196
1197 9/1/04: Update: Added more DOS partition types to mmls (submitted by
1198 Matt Kucenski)
1199
1200 9/2/04: Update: Added EXT3FS extended attributes and Posix ACL to istat
1201 output.
1202
1203 9/2/04: Update: Added free inode and block counts per group to fsstat for
1204 EXT2FS.
1205
1206 9/7/04: Bug Fix: FreeBSD compile error for PRIx printf stuff in mmtools/gpt.c
1207
1208
1209 ---------------- VERSION 1.71 --------------
1210 06/05/04: Update: Added sanity checks in fat to unix time conversion so that
1211 invalid times are set to 0.
1212
1213 06/08/04: Bug Fix: Added a type cast when size is assigned in FAT
1214 and removed the assignment to a 32-bit signed variable (which was no
1215 longer needed). (Bug: 966839)
1216
1217 06/09/04: Bug Fix: Added a type cast to the 'getuX' macros because some
1218 compilers were assuming it was signed (Bug: 966839).
1219
1220 06/11/04: Update: Changed NTFS magic check to use the aa55 at the
1221 end and fixed the name of the original "magic" value to oemname.
1222 The oemname is now printed in fsstat.
1223
1224 06/12/04: Bug Fix: The NTFS serial number was being printed with
1225 bytes in the wrong order in the fsstat output. (BUG: 972207)
1226
1227 06/12/04: Update: The begin offset value in index header for NTFS
1228 was 16-bits instead of 32-bits.
1229
1230 06/22/04: Update: Created a library for the MD5 and SHA1 functions so
1231 that it can be incorporated into other tools. Also renamed some of the
1232 indexing tools that hfind uses.
1233
1234 06/23/04: Update: Changed output of 'istat' for NTFS images. Added more
1235 data from $STANDARD_INFORMATION.
1236
1237 07/13/04: Update: Changed output of 'istat' for NTFS images again. Moved
1238 more data to the $FILE_NAME section and added new data.
1239
1240 07/13/04: Update: Changed code for processing NTFS runs and no
1241 longer check for the offset to be 0 in ntfs_make_data_run(). This
1242 could have prevented some sparse files from being processed.
1243
1244 07/13/04: Update: Added flags for compressed and encrypted NTFS
1245 files. They are not decrypted or uncompressed yet, just identified.
1246 They cannot be displayed from 'icat', but the known layout is given
1247 in 'istat'.
1248
1249 07/18/04: Bug Fix: Sometimes, 'icat' would report an error about an
1250 existing FILLER entry in an NTFS attribute. This was traced to
1251 instances when it was run on a non-base file record. There is now
1252 a check for that to not show the error. (BUG: 993459)
1253
1254 07/19/04: Bug Fix: A run of -1 may exist for sparse files in non-NT
1255 versions of NTFS. Changed check for this. reported by Matthew
1256 Kucenski. (BUG: 994024).
1257
1258 07/24/04: Bug Fix: NTFS attribute names were missing (rarely) on
1259 some files because the code assumed they would always be at offset
1260 64 for non-res attributes (Bug: 996981).
1261
1262 07/24/04: Update: Made listing of unallcoated NTFS file names less
1263 strict. There was a check for file name length versus stream length.
1264
1265 07/24/04: Update: Added $OBJECT_ID output to 'istat'
1266
1267 07/24/04: Update: Fixed ntfs.c compile warning about constant too
1268 large in time conversion code.
1269
1270 07/25/04: Update: Added attribute list contents to NTFS 'istat' output
1271
1272 07/25/04: Bug Fix: Not all slack space was being shown with 'dls -s'.
1273 It was documented that this occurs, but it is not what would be
1274 expected. (BUG: 997800).
1275
1276 07/25/04: Update: Changed output format of 'dls -s' so that it sends
1277 zeros where the file content was. Therefore the output is now a
1278 multiple of the data unit size. Also removed limitation to FAT &
1279 NTFS.
1280
1281 07/25/04: Update: 'dcalc' now has the '-s' option calculate the
1282 original location of data from a slack space image (dls -s).
1283 (from Chris Betz).
1284
1285 07/26/04: Update: Created the fs_os.h file and adjusted some of the
1286 header files for the PRI macros (C99). Created defines for OSes that do
1287 not have the macros already defined.
1288
1289 07/26/04: Non-release bug fix: Fixed file record size bug introduced with
1290 recent changes.
1291
1292 07/27/04: Update: Added GPT support to mmls.
1293
1294 07/29/04: Update: Added '-p' flag to 'ifind' to find deleted NTFS files
1295 that point to the given parent directory. Added '-l and -z' as well.
1296
1297
1298 ---------------- VERSION 1.70 --------------
1299 04/21/04: Update: Changed attribute and mode for FAT 'istat' so
1300 that actual FAT attributes are used instead of UNIX translation.
1301
1302 04/21/04: Update: The FAT 'istat' output better handles Long FIle
1303 Name entry
1304
1305 04/21/04: Update: The FAT 'istat' output better handles Volume Label
1306 entry
1307
1308 04/21/04: Update: Allowed the FAT volume label entry to be displayed
1309 with 'ils'
1310
1311 04/21/04: Update: Allowed the FAT volume label entry to be displayed
1312 with 'fls'
1313
1314 04/24/04: Update: 'dstat' on a FAT cluster now shows the cluster
1315 address in addition to the sector address.
1316
1317 04/24/04: Update: Added the cluster range to the FAT 'fsstat' output
1318
1319 05/01/04: Update: Improved the FAT version autodetect code.
1320
1321 05/02/04: Update: Removed 'H' flag from 'icat'.
1322
1323 05/02/04: Update: Changed all of the FS_FLAG_XXX variables in the
1324 file system tools to constants that are specific to the usage
1325 (NAME, DATA, META, FILE).
1326
1327 05/03/04: Update: fatfs_inode_walk now goes by sectors instead of clusters
1328 to get more dentries from slack space.
1329
1330 05/03/04: Bug Fix: The allocation status of FAT dentires was set only by
1331 the flag and not the allocation status of the cluster it is located in.
1332 (BUG: 947112)
1333
1334 05/03/04: Update: Improved comments and variable names in FAT code
1335
1336 05/03/04: Update: Added '-r' flag to 'icat' for deleted file recovery
1337
1338 05/03/04: Update: Added RECOVERY flag to file_walk for deleted file
1339 recovery
1340
1341 05/03/04: Update: Added FAT file recovery.
1342
1343 05/03/04: Update: Removed '-H' flag from 'icat'. Default is to
1344 display holes.
1345
1346 05/03/04: Update: 'fls -r' will recurse down deleted directories in FAT
1347
1348 05/03/04: Update: 'fsstat' reports FAT clusters that are marked as BAD
1349
1350 05/03/04: Update: 'istat' for FAT now shows recovery clusters for
1351 deleted files.
1352
1353 05/04/04: Update: Added output to 'fsstat' for FAT file systems by adding
1354 a list of BAD sectors and improving the amount of layout information. I
1355 also changed some of the internal variables.
1356
1357 05/08/04: Update: Removed addr_bsize from FS_INFO, moved block_frags
1358 to FFS_INFO, modified dcat output only data unit size.
1359
1360 05/20/04: Update: Added RECOVERY flag to 'ifind' so that it can find the
1361 data units that are allocated to deleted files
1362
1363 05/20/04: Update: Added icat recovery options to 'sorter'.
1364
1365 05/20/04: Update: Improved the naming convention in sorter for the 'ils'
1366 dead files.
1367
1368 05/21/04: Update: Added outlook to sorter rules (from David Berger)
1369
1370 05/27/04: Bug Fix: Added <linux/unistd.h> to mylseek.c so that it compiles
1371 with Fedora Core 2 (Patch by Angus Marshall) (BUG: 961908).
1372
1373 05/27/04: Update: Changed the letter with 'fls -l' for FIFO to 'p'
1374 instead of 'f' (reported by Dave Henkewick).
1375
1376 05/28/04: Update: Added '-u' flag to 'dcat' so that the data unit size
1377 can be specified for raw, swap, and dls image types.
1378
1379 05/28/04: Update: Changed the size argument of 'dcat' to be number of
1380 data units instead of size in bytes (suggestion by Harald Katzer).
1381
1382
1383 ---------------- VERSION 1.69 --------------
1384 03/06/04: Update: Fixed some memory leaks in ext2fs_close. reported
1385 by Paul Bakker.
1386 03/10/04: Bug Fix: If the '-s' flag was used with 'icat' on a EXT2FS
1387 or FFS file system, then a large amount of extra data came out.
1388 Reported by epsion. (BUG: 913874)
1389 03/10/04: Bug Fix: One of the verbose outputs in ext2fs.c was being sent
1390 to STDOUT instead of logfp. (BUG: 913875)
1391 04/14/04: Update: Added more data to fsstat output of FAT file system.
1392 04/15/04: Bug Fix: The last sector of a FAT file system may not
1393 be analyzed. (BUG: 935976)
1394 04/16/04: Update: Added full support for swap and raw by making the
1395 standard files and functions for them instead of the hack in dcat.
1396 Suggested by (and initial patch by) Paul Baker.
1397 04/18/04: Update: Changed error messages in EXT2/3FS code to be extXfs.
1398 04/18/04: Update: Updaged to version 4.09 of 'file'. This will
1399 help fix some of the problems people have had compiling it under
1400 OS X 10.3.
1401 04/18/04: Update: Added compiling support for SFU 3.5 (Microsoft). Patches
1402 from an anonymous person.
1403
1404
1405 ---------------- VERSION 1.68 --------------
1406 01/20/04: Bug Fix: FAT times were an hour too fast during daylight savings.
1407 Now use mktime() instead of manual calculation. Reported by Randall
1408 Shane. (BUG: 880606)
1409 02/01/04: Update: 'hfind -i' now reports the header entry as an invalid
1410 entry. The first header row was ignored.
1411 02/20/04: Bug Fix: indirect block pointer blocks would not be identified by
1412 the ifind tool. Reported by Knut Eckstein (BUG: 902709)
1413 03/01/04: Update: Added fs->seek_pos check to fs_read_random.
1414
1415 ---------------- VERSION 1.67 --------------
1416 11/15/03: Bug Fix: Added support for OS X 10.3 to src/makedefs. (BUG: 843029)
1417 11/16/03: Bug Fix: Mac partition tables could generate an error if there were
1418 VOID-type partitions. (BUG: 843366)
1419 11/21/03: Update: Changed NOABORT messages to verbose messages, so invalid
1420 data is not printed during 'ifind' searches.
1421 11/30/03: Bug Fix: icat would not hide the 'holes' if '-h' was given because
1422 the _UNALLOC flag was always being passed to file_walk. (reported by
1423 Knut Eckstein). (BUG: 851873)
1424 11/30/03: Bug Fix: NTFS data_walk was not using _ALLOC and _UNALLOC flags
1425 and other code that called it was not either. (BUG: 851895)
1426 11/30/03: Bug Fix: Not all needed commands were using _UNALLOC when they
1427 called file_walk (although for most cases it did not matter because
1428 sparse files would not be found in a directory for example). (Bug: 851897)
1429 12/09/03: Bug Fix: FFS and EXT2FS code was using OFF_T type instead of
1430 size_t for the size of the file. This could result in a file > 2GB
1431 as being a negative size on some systems (BUG: 856957).
1432 12/26/03: Bug Fix: ffind would crash for root directory of FAT image.
1433 Added NULL check and added a NULL name to fake root directory entry.
1434 (BUG: 871219)
1435 01/05/04: Bug Fix: The clustcnt value for FAT was incorrectly calculated
1436 and was too large for FAT12 and FAT16 by 32 sectors. This could produce
1437 extra entries in the 'fsstat' output when the FAT is dumped.
1438 (BUG: 871220)
1439 01/05/04: Bug Fix: ils, fls, and istat were not printing the full size
1440 of files that are > 2GB. (reported by Knut Eckstein) (BUG: 871457)
1441 01/05/04: Bug Fix: The EXT2FS and EXT3FS code was not using the
1442 i_dir_acl value as the upper 32-bits of regular files that are
1443 > 2GB (BUG: 871458)
1444 01/06/04: Mitigation: An error was reported where sorter would error
1445 that icat was being passed a '-1' argument. I can't find how that would
1446 happen, so I added quotes to all arguments so that the next time it
1447 occurs, the error is more useful (BUG: 845840).
1448 01/06/04: Update: Incorporated patch from Charles Seeger so that 'cc'
1449 can be used and compile time warnings are fixed with Sun 'cc'.
1450 01/06/04: Update: Upgraded file from v3.41 to v4.07
1451
1452
1453 ---------------- VERSION 1.66 --------------
1454 09/02/03: Bug Fix: Would not compile under OpenBSD 3 because fs_tools.h
1455 & mm_tools was missing a defined statment (reported by Randy - m0th_man)
1456 NOTE: Bugs now will have an entry into the Source Forge bug tracking
1457 sytem.
1458 10/13/03: Bug Fix: buffer was not being cleared between uses and length
1459 incorrectly set in NTFS resulted in false deleted file names being shown
1460 when the '-r' flag was given. The extra entries were from the previous
1461 directory. (BUG: 823057)
1462 10/13/03: Bug Fix: The results of 'sorter' varied depending on the version
1463 of Perl and the system. If the file output matched more than one,
1464 sorter could not gaurantee which would match. Therefore, results were
1465 different for some files and some machines. 'sorter' now enforces the
1466 ordering based on the order they are in the configuration file. The
1467 entries at the end of the file have priority over the first entries
1468 (generic rules to specific rules). (BUG: 823057)
1469 10/14/03: Update: 'mmls' prints 'MS LVM' with partition type 0x42 now.
1470 10/25/03: Bug Fix: NTFS could have a null pointer crash if the image
1471 was very corrupt and $Data was not found for the MFT.
1472 11/10/03: Bug Fix: NTFS 'ffind' would only report the file name and not
1473 the attribute name because the type and id were ignored. ffind and
1474 ntfs_dent were updated - found during NTFS keyword search test.
1475 (Bug: 831579()
1476 11/12/03: Update: added support for Solaris x86 partition tables to 'mmls'
1477 11/12/03: Update: Modified the sparc data structure to add the correct
1478 location of the 'sanity' magic value.
1479 11/15/03: Update: Added '-s' flag to 'icat' so that slack space is also
1480 displayed.
1481
1482 ---------------- VERSION 1.65 --------------
1483 08/03/03: Bug Fix: 'sorter' now checks for inode values that are too
1484 small to avoid 'icat' errors about invalid inode values.
1485 08/19/03: Update: 'raw' is now a valid type for 'dcat'.
1486 08/21/03: Update: mactime and sorter look for perl5.6.0 first.
1487 08/21/03: Update: Removed NSRL support from 'sorter' until a better
1488 wany to identify the known good and known bad files is found
1489 08/21/03: Bug Fix: The file path replaces < and > with HTML
1490 encoding for HTML output (ils names were not being shown)
1491 08/25/03: Update: Added 'nsrl.txt' describing why the NSRL functionality
1492 was removed.
1493 08/27/03: Update: Improved code in 'mactime' to reduce warnings when
1494 '-w' is used with Perl ('exists' checks on arrays).
1495 08/27/03: Update: Improved code in 'sorter' to reduce warnings when
1496 '-w' is used with Perl (inode_int for NTFS).
1497
1498 ---------------- VERSION 1.64 --------------
1499 08/01/03: Docs Fix: The Sun VTOC was documented as Virtual TOC and it
1500 should be Volume TOC (Jake @ UMASS).
1501 08/02/03: Bug Fix: Some compilers complained about verbose logging
1502 assignment in 'mmls' (Ralf Spenneberg).
1503
1504 ---------------- VERSION 1.63 --------------
1505 06/13/03; Update: Added 'mmtools' directory with 'dos' partitions
1506 and 'mmls'.
1507 06/18/03: Update: Updated the documents in the 'doc' directory
1508 06/19/03: Update: Updated error message for EXT3FS magic check
1509 06/27/03: Update: Added slot & table number to mmls
1510 07/08/03: Update: Added mac support to mmtools
1511 07/11/03: Bug Fix: 'sorter' was not processing all unallocated meta
1512 data structures because of a regexp error. (reported by Jeff Reava)
1513 07/16/03: Update: Added support for FreeBSD5
1514 07/16/03: Update: Added BSD disk labels to mmtools
1515 07/28/03: Update: Relaxed requirements for DOS directory entries, the wtime
1516 can be zero (reported by Adam Uccello).
1517 07/30/03: Update: Added SUN VTOC to mmtools
1518 07/31/03: Update: Added NetBSD support (adam@monkeybyte.org)
1519 08/01/03: Update: Added more sanity checks to FAT so that it would not
1520 try and process NTFS images that have the same MAGIC value
1521
1522 ---------------- VERSION 1.62 --------------
1523 04/11/03: Bug Fix: 'fsstat' for an FFS file system could report data
1524 fragments in the last group that were larger than the maximum
1525 fragment
1526 04/11/03: Bug Fix: 'ffs' allows the image to not be a multiple of the
1527 block size. A read error occured when it tried to read the last
1528 fragments since a whole block could not be read.
1529 04/15/03: Update: Added debug statements to FAT code.
1530 04/26/03: Update: Added verbose statements to FAT code
1531 04/26/03: Update: Added NOABORT flag to dls -s
1532 04/26/03: Update: Added stderr messages for errors that are not aborted
1533 because of NOABORT
1534 05/27/03: Update: Added 'mask' field to FATFS_INFO structure and changed
1535 code in fatfs.c to use it.
1536 05/27/03: Update: isdentry now checks the starting cluster to see if
1537 it is a valid size.
1538 05/27/03: Bug Fix: Added a sanitizer to 'sorter' to remove invalid chars
1539 from the 'file' output and reduce the warnings from Perl.
1540 05/28/03: Bug Fix: Improved sanitize expression in 'sorter'
1541 05/28/03: Update: Added '-d' option to 'mactime' to allow output to be
1542 given in comma delimited format for importing into a spread sheet or
1543 other graphing tool
1544 06/09/03: Update: Added hourly summary / indexing to mactime
1545 06/09/03: Bug Fix: sorter would not allow linux-ext3 fstype
1546
1547
1548 ---------------- VERSION 1.61 --------------
1549 02/05/03: Update: Started addition of image thumbnails to sorter
1550 03/05/03: Update: Updated 'file' to version 3.41
1551 03/16/03: Update: Added comments and NULL check to 'ifind'
1552 03/16/03: Bug Fix: Added a valid magic of 0 for MFT entries. This was
1553 found in an XP image.
1554 03/26/03: Bug Fix: fls would crash for an inode of 0 and a clock skew
1555 was given. fixed the bug in fls.c (debug help from Josep Homs)
1556 03/26/03: Update: Added more verbose comments to ntfs_dent.c.
1557 03/26/03: Bug Fix: 'ifind' for a path could return a result that was
1558 shorter than the requested name (strncmp was used)
1559 03/26/03: Update: Short FAT names can be used in 'ifind -n' and
1560 error messages were improved
1561 03/26/03: Bug Fix: A final NTFS Index Buffer was not always processed in
1562 ntfs_dent.c, which resulted in files not being shown. This was fixed
1563 with debugging help from Matthew Shannon.
1564 03/27/03: Update: Added an 'index.html' for image thumbnails in sorter
1565 and added a 'details' link from the thumbnail to the images.html file
1566 03/27/03: Update: 'sorter' can now take a directory inode to start
1567 processing
1568 03/27/03: Update: added '-z' flag when running 'file' in 'sorter' so that
1569 compressed file contents are reported
1570 03/27/03: Update: added '-i' flag to 'mactime' that creates a daily
1571 summary of events
1572 03/27/03: Update: Added support for Version 2 of the NSRL in 'hfind'
1573 04/01/03: Update: Added support for Hash Keeper to 'hfind'
1574 04/01/03: Update: Added '-e' flag to 'hfind' for extended info
1575 (currently hashkeeper only)
1576
1577
1578 ---------------- VERSION 1.60 --------------
1579 10/31/02: Bug Fix: the unmounting status of EXT2FS in the 'fsstat' command
1580 was not correct (reported by Stephane Denis).
1581 11/24/02: Bug Fix: The -v argument was not allowed on istat or fls (Michael
1582 Stone)
1583 11/24/02: Bug Fix: When doing an 'ifind' on a UNIX fs, it could abort if it
1584 looked at an unallocated inode with invalid indirect block pointers.
1585 This was fixed by adding a "NOABORT" flag to the walk code and adding
1586 error checks in the file system code instead of relying on the fs_io
1587 code. (suggested by Micael Stone)
1588 11/26/02: Update: ifind has a '-n' argument that allows one to specify a
1589 file name it and it searches to find the meta data structure for it
1590 (suggested by William Salusky).
1591 11/26/02: Update: Now that there is a '-n' flag with 'ifind', the '-d'
1592 flag was added to specify the data unit address. The old syntax of
1593 giving the data_unit at the end is no longer supported.
1594 11/27/02: Update: Added sanity checks on meta data and data unit addresses
1595 earlier in the code.
1596 12/12/02: Update: Added additional debug statements to NTFS code
1597 12/19/02: Update: Moved 'hash' directory to 'hashtools'
1598 12/19/02: Update: Started development of 'hfind'
1599 12/31/02: Update: Improved verbose debug statements to show full 64-bit
1600 offsets
1601 01/02/03: Update: Finished development of 'hfind' with ability to update
1602 for next version of NSRL (which may have a different format)
1603 01/05/03: Bug Fix: FFS and EXT2FS symbolic link destinations where not
1604 properly NULL terminated and some extra chars were appended in 'fls'
1605 (later reported by Thorsten Zachmann)
1606 01/06/03: Bug Fix: getu64() was not properly masking byte sizes and some
1607 data was being lost. This caused incorrect times to be displayed in some
1608 NTFS files.
1609 01/06/03: Bug Fix: ifind reported incorrect ownership for some UNIX
1610 file systems if the end fragments were allocated to a different file than
1611 the first ones were.
1612 01/07/03: Update: Renamed the src/mactime directory to src/timeline.
1613 01/07/03: Update: Updated README and man pages for hfind and sorter
1614 01/12/03: Bug Fix: ntfs_mft_lookup was casting a 64-bit value to a 32-bit
1615 variable. This caused MFT Magic errors. Reported and debugged by
1616 Keven Murphy
1617 01/12/03: Update: Added verbose argument to 'fls'
1618 01/12/03: Bug Fix: '-V' argument to 'istat' was doing verbose instead of
1619 version
1620 01/13/03: Update: Changed static sizes of OFF_T and DADDR_T in Linux
1621 version to the actual 'off_t' and 'daddr_t' types
1622 01/23/03: Update: Changed use of strtok_r to strtok in ifind.c so that
1623 Mac 10.1 could compile (Dave Goldsmith).
1624 01/28/03: Update: Improved code in 'hfind' and 'sorter' to handle
1625 files with spaces in the path (Dave Goldsmith).
1626
1627 ---------------- VERSION 1.52 --------------
1628 09/24/02: Bug Fix: Memory leak in ntfs_dent_idxentry(), ntfs_find_file(),
1629 and ntfs_dent_walk()
1630 09/24/02: Update: Removal of index sequences for index buffers is now
1631 done using upd_off, which will allow for NTFS to move the structure in
1632 the future.
1633 09/26/02: Update: Added create time for NTFS / STANDARD_INFO to
1634 istat output.
1635 09/26/02: Update: Changed the method that the NTFS time is converted
1636 to UNIX time. Should be more effecient.
1637 10/09/02: Update: dcat error changed.
1638 10/02/02: Update: Includes a Beta version of 'sorter'
1639
1640
1641 ---------------- VERSION 1.51 --------------
1642 09/10/02: Bug Fix: Fixed a design bug that would not allow attribute
1643 lists in $MFT. This bug would generate an error that complained about
1644 an invalid MFT entry in attribute list.
1645 09/10/02: Update: The size of files and directories is now calculated
1646 after each time proc_attrseq() is called so that it is more up to date
1647 when dealing with attribute lists. The size has the sizes of all
1648 $Data, $IDX_ROOT, and $IDX_ALLOC streams.
1649 09/10/02: Update: The maxinum number of MFT entries is now calculated
1650 each time an MFT entry is processed while loading the MFT. This
1651 allows us to reflect what the maximum possible MFT entry is at that
1652 given point based on how many attribute lists have been processed.
1653 09/10/02: Update: Added file version 3.39 to distro (bigger magic files)
1654 (Salusky)
1655 09/10/02: Bug Fix: fs_data was wasting memory when it was allocated
1656 09/10/02: Update: added a fs_data_alloc() function
1657 09/12/02: Bug Fix: Do not give an error if an attribute list of an
1658 unallocated file points to an MFT that no longer claims it is a
1659 member of the list.
1660 09/12/02: Update: No longer need version to remove update sequence
1661 values from on-disk buffers
1662 09/19/02: Bug Fix: fixed memory leak in ntfs_load_ver()
1663 09/19/02: Bug Fix: Update sequence errors were displayed because of a
1664 bug that occured when an MFT entry crossed a run in $MFT. Only occured
1665 with 512-byte clusters and an odd number of clusters in a run.
1666 09/19/02: Update: New argument to ils, istat, and fls that allows user to
1667 specify a time skew in seconds of the compromised system. Originated
1668 from discussion at DFRWS II.
1669 09/19/02: Update: Added '-h' argument to mactime to display header info
1670
1671 ---------------- VERSION 1.50 --------------
1672
1673 04/21/02: icat now displays idxroot attribute for NTFS directories
1674 04/21/02: fs_dent_print functions now are passed the FS_DATA structure
1675 instead of the extra inode and name strings. (NTFS)
1676 04/21/02: fs_dent_print functions display alternate data stream size instead
1677 of the default data size (NTFS)
1678 04/24/02: Fixed bug in istat that displayed too many fragments with ffs images
1679 04/24/02: Fixed bug in istat that did not display sparse files correctly
1680 04/24/02: fsstat of FFS images now identifies the fragments at the
1681 beginning of cyl groups as data fragments.
1682 04/26/02: Fixed bug in ext2fs_dent_parse_block that did not advance the
1683 directory entry pointer far enough each time
1684 04/26/02: Fixed bug in ext2fs_dent_parse_block so that gave an error if
1685 a file name was exactly 255 chars
1686 04/29/02: Removed the getX functions from get.c as they are now macros
1687 05/11/02: Added support for lowercase flag in FAT
1688 05/11/02: Added support for sequence values (NTFS)
1689 05/13/02: Added FS_FLAG_META for FAT
1690 05/13/02: Changed ifind so that it looks the block up to identify if it is
1691 a meta data block when an inode can not be found
1692 05/13/02: Added a conditional to ifind so that it handles sparse files better
1693 05/19/02: Changed icat so that the default attribute type is set in the
1694 file_walk function
1695 05/20/02: ils and dls now use boundary inode & block values if too large
1696 or small are given
1697 05/21/02: istat now displays all NTFS times
1698 05/21/02: Created functions to just display date and time
1699 05/24/02: moved istat functionality to the specific file system file
1700 05/25/02: added linux-ext3 flag, but no new features
1701 05/25/02: Added sha1 (so Autopsy can use the NIST SW Database)
1702 05/26/02: Fixed bug with FAT that did not return all slack space on file_walk
1703 05/26/02: Added '-s' flag to dls to extract slack space of FAT and NTFS
1704 06/07/02: fixed _timezone variable so correct times are shown in CYGWIN
1705 06/11/02: *_copy_inode now sets the flags for the inode
1706 06/11/02: fixed bug in mactimes that displayed a duplicate entry with time
1707 because of header entries in body file
1708 06/12/02: Added ntfs.README doc
1709 06/16/02: Added a comment to file Makefile to make it easier to compile for
1710 an IR CD.
1711 06/18/02: Fixed NTFS bug that showed ADS when only deleted files were supposed
1712 to be shown (when ADS in directory)
1713 06/19/02: added the day of the week to the mactime output (Tan)
1714 07/09/02: Fixed bug that added extra chars to end of symlink destination
1715 07/17/02: 1.50 Released
1716
1717
1718
1719 ---------------- VERSION 1.00 --------------
1720 - Integrated TCT-1.09 and TCTUTILs-1.01
1721 - Fixed bug in bcat if size is not given with type of swap.
1722 - Added platform indep by including the structures of each file system type
1723 - Added flags for large file support under linux
1724 - blockcalc was off by 1 if calculated using the raw block number and
1725 not the one that lazarus spits out (which start at 1)
1726 - Changed the inode_walk and block_walk functions slightly to return a
1727 value so that a walk can be ended in the middle of it.
1728 - FAT support added
1729 - Improved ifind to better handle fragments
1730 - '-z' flag to fls and istat now use the time zone string instead of
1731 integer value.
1732 - no longer prepend / in _dent
1733 - verify that '-m' directory in fls ends with a '/'
1734 - identify the destination of sym links
1735 - fsstat tool added
1736 - fixed caching bug with FAT12 when the value overlapped cache entries
1737 - added mactime
1738 - removed the <inode> value in fls when printing mac format (inode is now printed in mactime)
1739 - renamed src/misc directory to src/hash (it only has md5 and will have sha)
1740 - renamed aux directory to misc (Windows doesn't allow aux as a name ??)
1741 - Added support for Cygwin
1742 - Use the flags in super block of EXT2FS to identify v1 or v2
1743 - removed file system types of linux1 and linux2 and linux
1744 - added file system type of linux-ext2 (as ext3 is becoming more popular)
1745 - bug in file command that reported seek error for object files and STDIN
Something went wrong with that request. Please try again.