Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
Newer
Older
100644 1725 lines (1280 sloc) 70.978 kb
5668cd9 @bcarrier Updated NEWS.txt file with missing entries and changed format
bcarrier authored
1 Numbers refer to SourceForge.net tracker IDs:
2 http://sourceforge.net/tracker/?group_id=55685
1b20a34 @bcarrier fix for 2645156 that caused some FAT file slack to be missing in dls -s ...
bcarrier authored
3
2cb22de @bcarrier fixed issue 3108272 regarding fls flags.
bcarrier authored
4 ---------------- VERSION 3.2.1 --------------
5 Bug Fixes
6 - 3108272: fls arguments for -d and -u
6ea685c @bcarrier fix for 3043092 re: minor ifind logic issues
bcarrier authored
7
d530bcc @bcarrier added dummy entries to sqlite db if there is no volume system
bcarrier authored
8 New Features:
9 - A single dummy entry is added to the SQlite DB if no volume exists
10 so that all programs can assume that there will be at least one
11 volume in the table.
12
6ea685c @bcarrier fix for 3043092 re: minor ifind logic issues
bcarrier authored
13 ---------------- VERSION 3.2.0 --------------
14 Bug Fixes
15 - 3043092: Minor logic errors with ifind code.
7447626 @bcarrier minor bug fix in tsk_recover for file names in Unix
bcarrier authored
16 - FAT performance fix when looking for parent directories
17 in $OrphanFiles.
7eaa38c @bcarrier fixed issue 3052302 re: tsk_malloc trying to do a memset on data that wa...
bcarrier authored
18 - 3052302: Crash on NTFS/UFS detection test because of
19 corrupt data -- tsk_malloc error.
41e8227 @bcarrier patch for issue 3088447 regarding duplicate NTFS IDs
bcarrier authored
20 - 3088447: Error adding attribute because of run collision.
21 Solved by assigning unique IDs.
6ea685c @bcarrier fix for 3043092 re: minor ifind logic issues
bcarrier authored
22
9b5ee21 @bcarrier fix for 3012324 re: moving name mangling to outer layers and not in file...
bcarrier authored
23 New Features:
24 - 3012324: Name mangling moved out of library into outer tools
ad286b1 @bcarrier patch for 2993806 re: NONE value for ENUMs. Patch by Anthony Lawrence
bcarrier authored
25 so that they can see control characters if they want to. Patch
26 by Anthony Lawrence.
27 - 2993806: ENUM values have a specified NONE value if you don't
28 want to specify any special flags. Patch by Anthony Lawrence.
1036530 @bcarrier patch for 3026989 re: -e and -s flags to img_cat
bcarrier authored
29 - 3026989: Add -e and -s flags to img_cat. patch by Simson Garfinkel.
e24a2b6 @bcarrier patch 2941805 re: HFS case sensitive data by Rob Joyce.
bcarrier authored
30 - 2941805: Add case sensitive flag to fsstat in HFS. Patch by Rob Joyce.
a605ad0 @bcarrier patch for 3017764 re: not giving a fake name to NTFS attributes.
bcarrier authored
31 - 3017764: Changed how default NTFS $DATA attribute was named. Now it
32 has no name, while it previously had a fake name of "$Data".
41e8227 @bcarrier patch for issue 3088447 regarding duplicate NTFS IDs
bcarrier authored
33 - New TskAuto class.
34 - New tsk_loaddb, tsk_recover, tsk_comparedir, and tsk_gettimes tools.
9b5ee21 @bcarrier fix for 3012324 re: moving name mangling to outer layers and not in file...
bcarrier authored
35
1170040 @bcarrier resolved issue 3006733 re: slow directory listings because fs_dir_walk_l...
bcarrier authored
36 ---------------- VERSION 3.1.3 --------------
37 Bug Fixes
38 - 3006733: FAT directory listings were slow because the inner
39 code was not stopping when it found the parent directory.
044bb48 @bcarrier fixed fat checking errors in file name entries
bcarrier authored
40 - Adjusted sanity / testing code on FAT directory entries to allow
41 non-ascii in extensions and reject entries with lots of 0s.
7dad1e1 @bcarrier resolved issue 3023606 re: corrupt ext2 name
bcarrier authored
42 - 3023606: Ext2 / ffs corrupted file names.
57a0f78 @bcarrier applied NTFS SID patches from Mandiant
bcarrier authored
43 - Applied NTFS SID fixes from Mandiant.
4c3ffc8 @bcarrier applied ntfs_load_secure() memory leak from Michael Cohen.
bcarrier authored
44 - ntfs_load_secure() memory leak patch from Michael Cohen
1170040 @bcarrier resolved issue 3006733 re: slow directory listings because fs_dir_walk_l...
bcarrier authored
45
198bdd8 @bcarrier resolved issue 2982426 by not scanning entire image in search of parent ...
bcarrier authored
46 ---------------- VERSION 3.1.2 --------------
47 Bug Fixes
48 - 2982426: FAT directory listings were slow because the entire
49 image was being scanned for parent directory information.
12d0417 @bcarrier applied patch 2982965 to fix attribute length values
bcarrier authored
50 - 2982965: fs_attr length bug fix.
9d09230 @bcarrier fixed issue 2988619 re: mmls -B display errors
bcarrier authored
51 - 2988619: mmls -B display error.
451e395 @bcarrier applied patch from 2988330 for NTFS SII processing
bcarrier authored
52 - 2988330: ntfs SII cluster size increment bug
5cac172 @bcarrier fixed issue 2991487 re: zeroed content in NTFS files that are not fully ...
bcarrier authored
53 - 2991487: Zeroed content in NTFS files that were not fully intialized.
20ebf23 @bcarrier fix for 2993767 re: slow FAT directory listings because orphan files wer...
bcarrier authored
54 - 2993767: Slow FAT listings of OrphanFiles because hunt for parent
55 directory resulted in many searches for OrphanFiles. Added cache
56 of OrphanFiles.
92cb8e4 @bcarrier resolved issue 2999567 re: ifind not stopping after first hit
bcarrier authored
57 - 2999567: ifind was not stopping after first hit.
68dad51 @bcarrier resolved issue 2993804 re: not returning -1 on some reads past end of fi...
bcarrier authored
58 - 2993804: read past end of file did not always return -1.
198bdd8 @bcarrier resolved issue 2982426 by not scanning entire image in search of parent ...
bcarrier authored
59
27e8fb2 @bcarrier fixed issue 2954703 re: missing file in ISO9660
bcarrier authored
60 ---------------- VERSION 3.1.1 --------------
61
62 Bug Fixes
63 - 2954703: ISO9660 missing files because duplicate files
64 had same starting block.
15acd4f @bcarrier forgot this in the previous update
bcarrier authored
65 - 2954707: ISO9660 missing some files with zero length and
66 duplicate starting block. Also changed behavior of how
67 multiple volume descriptors are processed.
f17c950 @bcarrier resolved issue 2955898 re: missing orphan files if no deleted file names...
bcarrier authored
68 - 2955898: Orphan files not found if no deleted file names exist.
8bd7e62 @bcarrier resolved issue 2955899 re: NTFS setting of USED flag.
bcarrier authored
69 - 2955899: NTFS internal setting of USED flag.
e536877 @bcarrier resolved issue 2972721 re: sorter not cleaning up MD5sum output that som...
bcarrier authored
70 - 2972721: Sorter fails with hash lookup if '-l' is given.
c3adb4a @bcarrier resolved issue 2941813 re: incorrect internal HFS case sensitive flags
bcarrier authored
71 - 2941813: Reverse HFS case sensitive flags (internal fix only)
af60d07 @bcarrier fixed 2954448 re: Debian package typos and flags
bcarrier authored
72 - 2954448: Debian package typo fixes, etc.
951c215 @bcarrier resolved issue 2975245 re: sorter and realloc entries
bcarrier authored
73 - 2975245: sorter ignores realloc entries to reduce misleading mismatch entries and duplicate entries.
27e8fb2 @bcarrier fixed issue 2954703 re: missing file in ISO9660
bcarrier authored
74
75
5668cd9 @bcarrier Updated NEWS.txt file with missing entries and changed format
bcarrier authored
76 ---------------- VERSION 3.1.0 --------------
7956fd3 @bcarrier Applied patch from 2857258 for HFS flags
bcarrier authored
77
5668cd9 @bcarrier Updated NEWS.txt file with missing entries and changed format
bcarrier authored
78 New Features and Changes
79 - 2206285: HFS+ can now be read. Lots of tracker items about this.
80 Thanks to Rob Joyce and ATC-NY for many of the patches and reports.
81 - 2677069: DOS Safety Partitions in GPT Volume Systems are better
82 detected instead of reporting multiple VSs.
83 - Windows executables can be build in Visual Studio w/out needing
84 other image format libraries.
85 - 2367426: Uninitialized file space is shown if slack space is
86 requested.
87 - 2677107 All image formats supported by AFFLIB can be accessed by
88 specifying the "afflib" type.
89 - 2206265: sigfind can now process non-raw files.
90 - 2206331: Indirect block addresses are now available in the library
91 and command line tools. They are stored in a different attribute.
92 - Removed 'docs' files and moved them to the wiki.
93 - Removed disk_stat and disk_sreset because they were out of date
94 and hdparm now has the same functionality.
95 - 2874854: Image layer tools now support non-512 byte device sector
96 sizes. Users can specify sector size using the -b argument to the
97 command line tools. This has several consequences:
98 -- 'mmls -b' is now 'mmls -B'. Similarly with istat -b.
99 -- Changed command line format for '-o' so that sector size is
100 specified only via -b and not using '-o 62@4096'.
101 - 2874852: Sanity checking on partition table entires is relaxed
102 and only first couple of partitions are checked to make sure that
103 they can fit into the image.
104 - 2895607: NTFS SID data is available in the library and 'istat'.
105 - 2206341: AFF encrypted images now give more proper error message
106 if password is not given.
107 - 2351426: mactime is now distributed with Windows execs.
108
109
110 Developer-level Changes
111 - Abstracted name comparison to file system-specific function.
112 - Added support in mactime to read body files with comment lines.
113 - 2596153: Changed img_open arguments, similar to getopt().
114 - 2797169: tsk_fs_make_ls is now supported as an external library
115 function. Now named tsk_fs_meta_make_ls.
116 - 2908510: Nanosecond resolution of timestamps is now available.
117 - 2914255: Version info is now available in .h files in both string
118 and integer form.
119
120 Bug Fixes:
121 - 2568528: incorrect adjustment of attribute FILLER offset.
122 - 2596397: Incorrect date sorting in mactime.
123 - 2708195: Errors when doing long reads in fragmented attributes.
124 - Fixed typo bugs in sorter (reported via e-mail by Drew Hunt).
125 - 2734458: added orphan cache map to prevent slow NTFS listing times.
126 - 2655831: Sorter now knows about the ext2 and ext3 types.
127 - 2725799: ifind not converting UTF16 names properly on Windows
128 because it was using endian ordering of file system and not local
129 system.
130 - 2662168: warning messages on macs when reading the raw character
131 device.
132 - 2778170: incorrect read size on resident attributes.
133 - 2777633: missing second resolution on FAT creation times.
134 - Added the READ_SHARE option to the CreateFile command for split
135 image files. Patch by Christopher Siwy.
136 - 2786963: NTFS compression infinite loop fix.
137 - 2645156: FAT / blkls error getting slack because allocsize was
138 being set too small (and other values were not being reset).
139 - 2367426: Zeros are set for VDL slack on NTFS files.
140 - 2796945: Inifite loop in fs_attr.
141 - 2821031: Missing fls -m fields.
142 - 2840345: Extended DOS partitions in extended partitions are now
143 marked as Meta.
144 - 2848162: Reading attributes at offsets that are on boundary of
145 run fragment.
146 - 2824457: Fixed issue reading last block of file system with blkcat.
147 - 2891285: Fixed issue that prevented reads from the last block of
148 a file system when using the POSIX-style API.
149 - 2825690: Fixed issue that prevented blkls -A from working.
150 - 2901365: Allow FAT files to have a 0 wdate.
151 - 2900761: Added FAT directory sanity checks to prevent infinite loops.
152 - 2895607: Fixed various memory leaks.
153 - 2907248: Fixed image layer cache crash.
154 - 2905750: all file system read() functions now return -1 when
155 offset given is past end of file.
a30ae04 @bcarrier Addressed issue 2901365 re: missing FAT files by allowing wdate to be 0
bcarrier authored
156
64ba054 @bcarrier applied recurisve sanity checks for parent directory finding (issue 2900...
bcarrier authored
157
4e466f1 @bcarrier Arranged CHANGES file to include 3.0.1 release
bcarrier authored
158 ---------------- VERSION 3.0.1 --------------
159 11/11/08: Bug Fix: Fixed crashing bug in ifind on FAT file system.
160 Bug: 2265927
161
162 11/11/08: Bug Fix: Fixed crashing bug in istat on ExtX $OrphanFiles
163 dir. Bug: 2266104
164
165 11/26/08: Update: Updated fls man page.
166
167 11/30/08: Update: Removed TODO file and using tracker for bugs and
168 feature requests.
169
170 12/29/08: Bug Fix: Fixed incorrectly setting block status in file_walk
171 for compressed files (Bug: 2475246)
172
173 12/29/08: Bug Fix: removed fs_info field from FS_META because it
174 was not being set and should have been removed in 3.0. Reported by
175 Rob Joyce and Judson Powers.
176
177 12/29/08: Bug Fix: orphan files and NTFS files found via parent
178 directory have an unknown file name type (instead of being equal
179 to meta type). (Bug: 2389901). Reported by Barry Grundy.
180
181 1/12/09: Bug Fix: Fixed ISO9660 bug where large directory contents
182 were not displayed. (Bug: 2503552). Reported by Tom Black.
183
184 1/24/09: Bug Fix: Fixed bug 2534449 where extra NTFS files were
185 shown if the MFT address was changed to 0 because fs_dir_add was
186 checking the address and name. Reported by Andy Bontoft.
187
188 1/29/09: Update: Fixed fix for bug 2534449. The fix is in ifind
189 instead of fs_dir_add().
190
191 2/2/09: Update: Added RPM spec file from Morgan Weetmam.
192
193
5d365e3 @bcarrier Removed fs_info from FS_META
bcarrier authored
194 ---------------- VERSION 3.0.0 --------------
3a78df5 @bcarrier initial import from CVS
bcarrier authored
195 0/00/00: Update: Many, many, many API changes.
196
197 2/14/08: Update: Added mmcat tool.
198
199 2/26/08: Update: Added flags to mmls to specify partition types.
200
201 3/1/08: Update: Major update of man pages.
202
203 4/14/08: Bug Fix: Fixed the calculation of "actual" last block.
204 Off by 1 error. Reported by steve.
205
206 5/23/08: Bug Fix: Incorrect malloc return check in srch_strings.
207 reported by Petri Latvala.
208
209 5/29/08: Bug Fix: Fixed endian ordering bug in ISO9660 code. Reported
210 by Eduardo Aguiar de Oliveira.
211
212 6/17/08: Update: 'sorter' now uses the ifind method for finding
213 deleted NTFS files (like Autopsy) does instead of relying on fls.
214 Reported by John Lehr.
215
216 6/17/08: Update: 'ifind -p' reports data on ADS.
217
218 7/10/08: Update: FAT looks for a backup boot sector in FAT32 if
219 magic is 0
220
221 7/21/08: Bug Fix: Changed define of strcasecmp to _stricmp instead
222 of _strnicmp in Windows. (reported by Darren Bilby).
223
224 7/21/08: Bug Fix: Fall back to open "\\.\" image files on Windows
225 with SHARE_WRITE access so that drive devices can be opened.
226 (reported by Darren Bilby).
227
228 8/20/08: Bug Fix: Look for Windows objects when opening files in
229 Cygwin, not just Win32. Reported by Par Osterberg Medina.
230
231 8/21/08: Update: Renamed library and install header files to have a '3'
232 in them to allow parallel installations of v2 and v3. Suggested by
233 Simson Garfinkel.
234
235 8/22/08: Update: Added -b option to sorter to specify minimum file size
236 to process. Suggested by Jeff Kell.
237
238 8/22/08: Update: Added libewf as a requirement to build win32 so that
239 E01 files are supported.
240
241 8/29/08: Update: Added initial mingw patches for cross compiling and
242 Windows. Patches by Michael Cohen.
243
244 9/X/08: Update: Added ability to access attibutes
245
246 9/6/08: Update: Added image layer cache.
247
248 9/12/08: Bug Fix: Fixed crash from incorrectly cleared value in FS_DIR
249 structure. Reported and patched by Jason Miller.
250
251 9/13/08: Update: Changed d* tool names to blk*.
252
253 9/17/08: Update: Finished mingw support so that both tools and
254 library work with Unicode file name support.
255
256 9/22/08: Update: Added new HFS+ code from Judson Powers and Rob Joyce (ATC-NY)
257
258 9/24/08: Bug Fix: Fixed some cygwin compile errors about types on Cygwin.
259 Reported by Phil Peacock.
260
261 9/25/08: Bug Fix: Added O_BINARY to open() in raw and split because Cygwin
262 was having problems. Reported by Mark Stam.
263
7561820 @bcarrier Added ifndef around TSK_USE_HFS
bcarrier authored
264 10/1/08: Update: Added ifndef to TSK_USE_HFS define to allow people
265 to define it on the command line. Patch by RB.
266
3a78df5 @bcarrier initial import from CVS
bcarrier authored
267
268 ---------------- VERSION 2.52 --------------
269 2/12/08: Bug Fix: Fixed warning messages in mactime about non-Numeric
270 data. Reported by Pope.
271
272 2/19/08: Bug Fix: Added #define to tsk_base_i.h to define
273 LARGEFILE64_SOURCE based on LARGEFILE_SOURCE for older Linux systems.
274
275 2/20/08: Bug Fix: Updated afflib references and code.
276
277 3/13/08: Update: Added more fixes to auto* so that AFF will compile
278 on more systems. I have confirmed that AFFLIB 3.1.3 will run with
279 OS X 10.4.11.
280
281 3/14/08: Bug Fix: Added checks to FAT code that calcs size of
282 directories. If starting cluster of deleted dir points into a
283 cluster chain, then problems can occur. Reported by John Ward.
284
285 3/19/08: Update: I have verified that this compiles with libewf-20070512.
286
287 3/21/08: Bug Fix: Deleted Ext/FFS directories were not being recursed
288 into. This case was rare (because typically the metadata are
289 wiped), but possible. Reported by JWalker.
290
291 3/24/08: Update: I have verified that this compiles with libewf-20080322.
292 Updates from Joachim Metz.
293
294 3/26/08: Update: Changed some of the header file design for the tools
295 so that the define settings in tsk_config.h can be used (for large files).
296
297 3/28/08: Update: Added config.h reference to srch_strings to get the
298 LARGEFILE support.
299
300 4/5/08: Update: Improved inode argument number parsing function.
301
302
303 ---------------- VERSION 2.51 --------------
304 1/30/08: Bug Fix: Fixed potential infinite loop in fls_lib.c. Patch
305 by Nathaniel Pierce.
306
307 2/7/08: Bug Fix: Defined some of the new constants that are used
308 in disktools because older Linux distros did not define them.
309 Reported by Russell Reynolds.
310
311 2/7/08: Bug Fix: Modified autoconf to check for large file build
312 requirements and look for new 48-bit structures needed by disktools.
313 Both of these were causing problems on older Linux distros.
314
315 2/7/08: Update: hfind will normalize hash values in database so
316 that they are case insensitive.
317
318 ---------------- VERSION 2.50 --------------
319 12/19/07: Update: Finished upgrade to autotools building design. No
320 longer include file, afflib, libewf. Resulted in many source code layout
321 changes and sorter now searches for md5, sha1, etc.
322
323 ---------------- VERSION 2.10 --------------
324 7/12/07: Update: 0s are returned for AFF pages that were not imaged.
325
326 7/31/07: Bug Fix: ifind -p could crash if a deleted file name was found
327 that did not point to a valid meta data stucture. (Reported by Andy Bontoft)
328
329 8/5/07: Update: Added NSRL support back into sorter.
330
331 8/15/07: Update: Errors are given if supplied sector offset is larger than
332 disk image. Reported by Simson Garfinkel.
333
334 8/16/07: Update: Renamed MD5 and SHA1 functions to TSK_MD5_.. and TSK_SHA_....
335
336 8/16/07: Update: tsk_error_get() does not reset the error messages.
337
338 9/26/07: Bug Fix: Changed FATFS check for valid dentries to consider
339 second values of 30. Reported by Alessandro Camillo.
340
341 10/18/07: Update: inode_walk for NTFS and FAT will not abort if
342 data corruption is found in one entry -- instead they will just
343 skip it.
344
345 10/18/07: Update: tsk_os.h uses standard gcc system names instead
346 of TSK specific ones.
347
348 10/18/07: Update: Updated raw.c to use ioctl commands on OS X to
349 get size of raw device because it does not work with SEEK_END.
350 Patch by Rob Joyce.
351
352 10/31/07: Update: Finished upgrade to fatfs_file_walk_off so that
353 walking can start at a specific offset. Also finished upgrade that
354 caches FAT run list to make the fatfs_file_walk_off more effecient.
355
356 11/14/07: Update: Fixed few places where off_t was being used
357 instead of OFF_T. Reported by GiHan Kim.
358
359 11/14/07: Update: Fixed a memory leak in aff.c to free AFF_INFO.
360 Reported by GiHan Kim.
361
362 11/24/07: Update: Finished review and update of ISO9660 code.
363
364 11/26/07: Bug Fix: Fixed 64-bit calculation in HFS+ code. Submitted
365 by Rob Joyce.
366
367 11/29/07: Update: removed linking of srch_strings.c and libtsk. Reported by
368 kwizart.
369
370 11/30/07: Upate: Made a #define TSK_USE_HFS compile flag for incorporating
371 the HFS support (flag is in src/fstools/fs_tools_i.h)
372
373 11/30/07: Update: restricted the FAT dentry sanity checks to verify
374 space padding in the name and latin-only extensions.
375
376 12/5/07: Bug Fix: fs_read_file_int had a bug that ignored the type passed
377 for NTFS files. Reported by Dave Collett.
378
379 12/12/07: Update: Changed teh FAT dentry sanity checks to allow spaces
380 in volume labels and do more checking on the attribute flag.
381
382
383
384
385 ---------------- VERSION 2.09 --------------
386 4/6/07: Bug Fix: Inifite loop in ext2 and ffs istat code because of using
387 unsigned size_t variable. Reported by Makoto Shiotsuki.
388
389 4/16/07: Bug Fix: Changed use of fseek() to fseeko() in hashtools. Patch
390 by Andy Bontoft.
391
392 4/16/07: Bug Fix: Changed Win32 SetFilePointer to use LARGE_INTEGER.
393 Reported by Kim GiHan.
394
395 4/19/07: Bug Fix: Not all FAT orphan files were being found because of
396 and offset error.
397
398 4/26/07: Bug Fix: ils -O was not working (link value not being
399 checked). Reported by Christian Perst.
400
401 4/27/07: Bug Fix: ils -r was showing UNUSED inodes. Reported by
402 Christian Perst.
403
404 5/10/07: Update: Redefined the USED and UNUSED flags for NTFS so that
405 UNUSED is set when no attributes exist.
406
407 5/16/07: Bug Fix: Fixed several bounds checking bugs that may cause
408 a crash if the disk image is corrupt. Reported by Tim Newsham (iSec
409 Partners)
410
411 5/17/07: Update: Updated AFFLIB to 2.2.11
412
413 5/17/07: Update: Updated libewf to libewf-20070512
414
415 5/17/07: Update: Updated file to 4.20
416
417 5/29/07: Update: Removed NTFS SID/SDS contributed code because it causes
418 crashes on some systems and its output is not entirely clear. (most recent bug
419 reported by Andy Scott)
420
421 6/11/07: Update: Updated AFFLIB to 2.2.12.
422
423 6/12/07: Bug Fix: ifind -p was not reporting back info on the allocated name
424 when one existed (because strtok was overwritting the name when the search
425 continued). Reported by Andy Bontoft.
426
427 6/13/07: Update: Updated file to 4.21
428
429
430 ---------------- VERSION 2.08 --------------
431 12/19/06: Bug Fix: ifind_path was not setting *result when root inode
432 was searched for. patch by David Collett.
433
434 12/29/06: Update: Removed 'strncpy' in ntfs.c to manual assignment of
435 text for '$Data' and 'N/A' for performance reasons.
436
437 1/11/07: Update: Added duname to FS_INFO that contains a string of
438 name for a file system's data unit -- Cluster for example.
439
440 1/19/07: Bug Fix: ifind_path was returning an error even after some
441 files were found. Errors are now ignored if a file was found.
442 Reported by Michael Cohen.
443
444 1/26/07: Bug Fix: Fixed calcuation of inode numbers in fatfs.c
445 (reported by Simson Garfinkel).
446
447 2/1/07: Update: Changed aff-install to support symlinked directory.
448
449 2/1/07: Update: img_open modified so that it does not report errors for
450 s3:// and http:// files that do not exist.
451
452 2/5/07: Update: updated *_read() return values to look for "<0" instead of
453 simply "== -1". (suggested by Simson Garfinkel).
454
455 2/8/07: Update: removed typedef for uintptr in WIN32 code.
456
457 2/13/07: Update: Applied patch from Kim Kulak to update HFS+ code to internal
458 design changes.
459
460 2/16/07: Update: Renamed many of the external data structures and flags
461 so that they start with TSK_ or tsk_ to prevent name collisions.
462
463 2/16/07: Update: Moved MD5 and SHA1 routines and binaries to auxtools
464 instead of hashtools so that they are more easy to access.
465
466 2/16/07: Update: started redesign and port of hashtools.
467
468 2/21/07: Update: Changed inode_walk callback API to remove the flags
469 variable -- this was redundant since flags are also in TSK_FS_INODE.
470 Same for TSK_FS_DENT.
471
472 3/7/07: Bug Fix: fs_read_file failed for NTFS resident files. Reported
473 by Michael Cohen.
474
475 3/8/07: Bug Fix: FATFS assumed a 512-byte sector in a couple of locations.
476
477 3/13/07: Update: Finished hashtools update.
478
479 3/13/07: Update: dcat reads block by block instead of all at once.
480
481 3/23/07: Update: Change ntfs_load_secure to allocate all of its
482 needed memory at once instead of doing reallocs.
483
484 3/23/07: Update: Updated AFFLIB to 2.2.0
485
486 3/24/07: Bug Fix: Fixed many locations where return value from strtoull
487 was not being properly checked and therefore invalid numbers were not
488 being detected.
489
490 3/24/07: Bug Fix: A couple of error messages in ntfs_file_walk should
491 have been converted to _RECOVER when the _RECOVERY flag was given.
492
493 3/24/07: Update: Changed behavior of ntfs_file_walk. If no type is
494 given, then a default type is chosen for files and dirs. Now, no error
495 is generated if that type does not exist -- similar to how no error is
496 generated if a FAT file has 0 file size.
497
498 3/26/07: Update: cleaned up and documented fs_data code more.
499
500 3/29/07: Update: Updated AFF to 2.2.2.
501
502 3/29/07: Update: Updated install scripts for afflib, libewf, and file to
503 touch files so that the auto* files are in the correct time stamp order.
504
505 4/5/07: Bug Fix: Added sanity checks to offsets and addresses in ExtX and
506 UFS group descriptors. Reported by Simson Garfinkel.
507
508
509 ---------------- VERSION 2.07 --------------
510 9/6/06: Update: Changed TCHAR and _T to TSK_TCHAR and _TSK_T to avoid
511 conflicts with other libraries.
512
513 9/18/06: Update: Added tsk_list_* functions and strutures.
514
515 9/18/06: Update: Added checks for recursive FAT directories.
516
517 9/20/06: Update: Changed FS_META_* flags for LINK and UNLINK and moved
518 them to ILS_? flags.
519
520 9/20/06: Update: added flags to ils to find only orphan inodes.
521
522 9/20/06: Update: Added Orphan support for FAT, NTFS, UFS, Ext2, ISO.
523
524 9/20/06: Update: File walk actions now have a flag to identify if a block
525 is SPARSE or not (used to identify if the address being passed is valid
526 or made up).
527
528 9/21/06: Update: Added file size sanity check to fatfs_is_dentry and
529 fixed assignment of fatfs->clustcnt.
530
531 9/21/06: Update: block_, inode, and dent_walk functions now do more flag
532 checking and make sure that some things are set instead of making the
533 calling code do it.
534
535 9/21/06: Update: Added checks for recursive (infinite loop) NTFS, UFS,
536 ExtX, and ISO9660 directories.
537
538 9/21/06: Update Added checks to make sure that walking the FAT for files
539 and directories would result in an infinite loop (if FAT is corrupt).
540
541 9/21/06: Update: Added -a and -A to dls to specify allocated and
542 unallocated blocks to display.
543
544 9/21/06: Update: Updated AFFLIB to 1.6.31.
545
546 9/22/06: Update: added a fs_read_file() function that allows you to read
547 random parts of a file.
548
549 10/10/06: Update: Improved performance of fs_read_file() and added
550 new FS_FLAG_META_COMP and FS_FLAG_DATA_COMP flags to show if a file
551 and data are using file system-level compression (NTFS only).
552
553 10/18/06: Bug fix: in fs_data_put_run, added a check to see
554 if the head was null before looking up. An extra error message
555 was being created for nothing.
556
557 10/18/06: Bug Fix: Added a check to the compression buffer
558 to see if it is null in _done().
559
560 10/25/06: Bug Fix: Added some more bounds checks to NTFS uncompression code.
561
562 11/3/06: Bug Fix: added check to dcat_lib in case the number of blocks
563 requested is too large.
564
565 11/07/06: Update: Added fs_read_file_noid wrapper around fs_read_file
566 interface.
567
568 11/09/06: Update: Updated AFF to 1.7.1
569
570 11/17/06: Update: Updated libewf to 20061008-1
571
572 11/17/06: Bug Fix: Fixed attribute lookup bug in fs_data_lookup.
573 Patch by David Collett.
574
575 11/21/06: Bug Fix: Fixed fs_data loops that were stopping when they hit
576 an unused attribute. Patch by David Collett.
577
578 11/21/06: Bug Fix: sorter no longer clears the path when it starts. THis
579 was causing errors on Cygwin because OpenSSL libraries could not be found.
580
581 11/22/06: Update: Added a tskGetVersion() function to return the string
582 of the current version.
583
584 11/29/06: Update: Added more tsk_error_resets to more places to prevent
585 extra error messages from being displayed.
586
587 11/30/06: Update: Added Caching to the getFAT function and to fs_read.
588
589 12/1/06: Update: Changed TSK_LIST to a reverse sorted list of buckets.
590
591 12/5/06: Bug Fix: Fixed FS_DATA_INUSE infinite loop bug.
592
593 12/5/06: Bug Fix: Fixed infinite loop bug with NTFS decompression code.
594
595 12/5/06: Update: Added NULL check to fs_inode_free (from Michael Cohen).
596
597 12/5/06: Update: Updated ifind_path so that an allocated name will be
598 shown if one exists -- do not exit if we find simply an unallocated
599 entry with an address of 0. Suggested by David Collett.
600
601 12/6/06: Update: Updated file to version 4.18.
602
603 12/6/06: Update: Updated libaff to 2.0a10 and changed build process
604 accordingly.
605
606 12/7/06: Update: Added a tsk_error_get() function that returns a string
607 with the error messages -- can be used instead of tsk_error_print.
608
609 12/7/06: Update: fixed some memory leaks in FAT and NTFS code.
610
611 12/11/06: Bug Fix: fatfs_open error message code referenced a value that
612 was in freed memory -- reordered statements.
613
614 12/15/06: Update: Include VCProj files in build.
615
616
617 ---------------- VERSION 2.06 --------------
618 8/11/06: Bug Fix: Added back in ASCII/UTF-8 checks to remove control
619 characters in file names.
620
621 8/11/06: Bug Fix: Added support for fast sym links in UFS1
622
623 8/11/06: Update: Redesigned the endian support so that getuX takes only
624 the endian flag so that the Unicode design could be changed as well.
625
626 8/11/06: Update: Redesigned the Unicode support so that there is a
627 tsk_UTF... routine instead of fs_UTF...
628
629 8/11/06: Update: Updated GPT to fully convert UTF16 to UTF8.
630
631 8/11/06: Update: There is now only one aux_tools header file to include
632 instead of libauxtools and/or aux_lib, which were nearly identical.
633
634 8/16/06: Bug Fix: ntfs_dent_walk could segfault if two consecutive
635 unallocated entries were found that had an MFT entry address of 0.
636 Reported by Robert-Jan Mora.
637
638 8/16/06: Update: Changed a lot of the header files and reduced them so
639 that it is easier to use the library and only one header file needs to
640 be included.
641
642 8/21/06: Update: mmtools had char * instead of void * for walk callback
643
644 8/22/06: Update: Added fs_load_file function that returns a buffer full
645 with the contents of a file.
646
647 8/23/06: Update: Upgraded AFFLIB to 1.6.31 and libewf to 20060820-1.
648
649 8/25/06: Update: Created printf wrappers so that output is UTF-16 on
650 Windows and UTF-8 on Unix.
651
652 8/25/06: Update: Continued port to Windows by starting to use more
653 TCHARS and defining needed macros for the Unix side.
654
655 8/25/06: Bug Fix: Fixed crash that could occur because of SDS code
656 in NTFS. (reported by Simson Garfinkel) (BUG: 1546925).
657
658 8/25/06: Bug Fix: Fixed crash that could occur because path stack became
659 corrupt with deep directories or corrupt images. (reported by Simson
660 Garfinkel) (BUG: 1546926).
661
662 8/25/06: Bug Fix: Fixed infinite loop that could occur when trying to
663 determine size of FAT directory when the FAT has a loop in it. (BUG:
664 1546929)
665
666 8/25/06: Update: Improved FAT checking code to look for '.' and '..'
667 entries when inode value is replaced during dent_walk.
668
669 8/29/06: Update: Finished Win32 port and changes to handle UTF-16 vs
670 UTF-8 inputs.
671
672 8/29/06: Update: Created a parse_inum function to handle parsing inode
673 addresses from command line.
674
675 8/30/06: Update: Made progname a local variable instead of global.
676
677 8/31/06: Bug Fix: Fixed a sizeof() error with the memset in fatfs_inode_walk
678 for the sect_alloc buffer.
679
680 8/31/06: Update: if mktime in dos2unixtime returns any negative value,
681 then the return value is set to 0. Windows and glibc seem to have
682 different return values.
683
684 ---------------- VERSION 2.05 --------------
685 5/15/06: Bug Fix: Fixed a bug in img_cat that could cause it to
686 go into an infinite loop. (BUG: 1489284)
687
688 5/16/06: Update: Fixed printf statements in tsk_error.c that caused
689 warning messages for some compilers. Reported by Jason DePriest.
690
691 5/17/06: Update: created a union of file system-specific file times in
692 FS_INFO (Patch by Wyatt Banks)
693
694 5/22/06: Bug Fix: Updated libewf to 20060520 to fix bug with reported
695 image size. (BUG: 1489287)
696
697 5/22/06: Bug Fix: Updated AFFLIB to 1.6.24 so that TSK could compile in
698 CYGWIN. (BUG: 1493013)
699
700 5/22/06: Update: Fixed some more printf statements that were causing
701 compile warnings.
702
703 5/23/06: Update: Added a file existence check to img_open to make error
704 message more accurate.
705
706 5/23/06: Update: Usage messages had extra "Supported image types message".
707
708 5/25/06: Update: Added block / page range to fsstat for raw and swapfs.
709
710 6/5/06: Update: fixed some typos in the output messages of sigfind (reported
711 by Jelle Smet)
712
713 6/9/06: Update: Added HFS+ template to sigfind (Patch by Wyatt Banks)
714
715 6/9/06: Update: Added ntfs and HFS template to sigfind.
716
717 6/19/06: Update: Begin Windows Visual Studio port
718
719 6/22/06: Update: Updated a myflags check in ntfs.c (reported by Wyatt Banks)
720
721 6/28/06: Update: Incorporated NTFS compression patch from I.D.E.A.L.
722
723 6/28/06: Update: Incorporated NTFS SID patch from I.D.E.A.L.
724
725 6/28/06: Bug Fix: A segfault could occur with NTFS if no inode was loaded
726 in the dent_walk code. (Reported by Pope).
727
728 7/5/06: Update: Added tsk_error_reset function and updated code to use it.
729
730 7/5/06: Update: Added more sanity checks to the DOS partitions code.
731
732 7/10/06: Update: Upgraded libewf to version 20060708.
733
734 7/10/06: Update: Upgraded AFFLIB to version 1.6.28
735
736 7/10/06: Update: added 'list' option to usage message so that file
737 system, image, volume system types are listed only if '-x list' is given.
738 Suggested by kenshin.
739
740 7/10/06: Update: Compressed NTFS files use the compression unit size
741 specified in the header.
742
743 7/10/06: Update: Added -R flag to icat to suppress recovery warnings and
744 use this flag in sorter to prevent FAT recovery messages from filling
745 up screen.
746
747 7/10/06: Update: file_walk functions now return FS_ERR_RECOVERY error
748 codes for most cases if the RECOVERY flag is set -- this allows the
749 errors to be more easily suppressed.
750
751 7/12/06: Update: Removed individual libraries and now make a single
752 static libtsk.a library.
753
754 7/12/06: Update: Cleaned up top-level Makefile. Use '-C' flag (suggested
755 by kenshin).
756
757 7/14/06: Update: Fixed and redesigned some of the new NTFS compression
758 code. Changed variable names.
759
760 7/20/06: Update: Fixed an NTFS compression bug if a sub-block was not
761 compressed.
762
763 7/21/06: Update: Made NTFS compression code thread friendly.
764
765
766 ---------------- VERSION 2.04 --------------
767 12/1/05: Bug Fix: Fixed a bug in the verbose output of img_open
768 that would crash if no type or offset was given. Reported and
769 patched by Wyatt Banks.
770
771 12/20/05: Bug Fix: An NTFS directory index sanity check used 356
772 instead of 365 when calculating an upper bound on the times. Reported
773 by Wyatt Banks.
774
775 12/23/05: Bug Fix: Two printf statements in istat for NTFS printed
776 to stdout instead of a specific file handle. Reported by Wyatt
777 Banks.
778
779 1/22/06: Bug Fix: fsstat, imgstat and dcalc were using a char instead
780 of int for the return value of getopt, which caused some systems to not
781 execute the programs. (internal fix and later reported by Bernhard Reiter)
782
783 2/23/06: Update: added support for FreeBSD 6.
784
785 2/27/06: Bug Fix: Indirect blocks would nto be found by ifind with
786 UFS and Ext2. Reported by Nelson G. Mejias-Diaz. (BUG: 1440075)
787
788 3/9/06: Update: Added AFF image file support.
789
790 3/14/06: Bug Fix: If the first directory entry of a UFS or ExtX block
791 was unallocated, then later entries may not be shown. Reported by John
792 Langezaal. (BUG: 1449655)
793
794 4/3/06: Update: Finished the improved error handling. Many internal
795 changes, not many external changes. error() function no longer used
796 and instead tsk_err variables and function are used. This makes the
797 library more powerful.
798
799 4/5/06: Update: The byte offset for a volume is now passed to the mm_
800 and fs_ functions instead of img_open. This allows img_info to be used
801 for multiple volumes at the same time. This required some mm_ changes.
802
803 4/5/06: Update: All TSK libraries are written to the lib directory.
804
805 4/6/06: Update: Added FS_FLAG_DATA_RES flag to identify data that are
806 resident in ntfs_data_walk (suggested by Michael Cohen).
807
808 4/6/06: Update: The partition code (media Management) now checks that a
809 partition starts before the end of the image file. There are currently
810 no checks about the end of the partition though.
811
812 4/6/06: Update: The media management code now shows unpartitioned space
813 as such from the end of the last partition to the end of the image file
814 (using the image file size). (Suggested by Wyatt Banks).
815
816 4/7/06: Update: New version of ISO9660 code from Wyatt Banks and Crucial
817 Security added and other code updated to allow CDs to be analyzed.
818
819 4/7/06: There was a conflict with guessuXX with mmtools and fstools.
820 Renamed to mm_guessXX and fs_guessXX.
821
822 4/10/06: Upgraded AFFLIB to 1.5.6
823
824 4/12/06: Added version of libewf and support for it in imgtools
825
826 4/13/06: Added new img_cat tool to extract raw data from an image format.
827
828 4/24/06: Upgraded AFFLIB to 1.5.12
829
830 4/24/06: split and raw check if the image is a directory
831
832 4/24/06: Updated libewf to 20060423-1
833
834 4/26/06: Updated makedefs to work with SunOS 5.10
835
836 5/3/06: Added iso9660 patch from Wyatt Banks so that version number
837 is not printed with file name.
838
839 5/4/06: Updated error checking in icat, istat, fatfs_dent, and ntfs_dent
840
841 5/8/06: Updated libewf to 20060505-1 to fix some gcc 2 compile errors.
842
843 5/9/06: Updated AFFLIB to 1.6.18
844
845 5/11/06: Cleaned up error handling (removed %m and unused legacy code)
846
847 5/11/06: Updated AFFLIB to 1.6.23
848
849 ---------------- VERSION 2.03 --------------
850 7/26/05: Update: Removed incorrect print_version() statement from
851 fs_tools.h (reported by Jaime Chang)
852
853 7/26/05: Update: Renamed libraries to start with "lib"
854
855 7/26/05: Update: Removed the logfp variable for verbose statements
856 and instead use only stderr.
857
858 8/12/05: Update: If time is 0, then it is put as 00:00:00 instead of
859 the default 1970 or 1980 time.
860
861 8/13/05: Update: Added Unicode support for FAT and NTFS (Supported by
862 I.D.E.A.L. Technology Corp).
863
864 9/2/05: Update: Added Unicode support for UFS and ExtX. Non-printable
865 ASCII characters are no longer replaced with '^.'.
866
867 9/2/05: Update: Improved the directory entry sanity checks for UFS
868 and ExtX.
869
870 9/2/05: Update: Upgraded file to version 4.15.
871
872 9/2/05: Update: The dent_walk code of all file systems does not
873 abort if a sub-directory is encountered with an error. If it is the
874 top directory explicitly called, then it still gives an error.
875
876 9/2/05: Bug Fix: MD5 and SHA-1 values were incorrect under AMD64
877 systems because the incorrect variable sizes were being used.
878 (reported by: Regis Friend Cassidy. BUG: 1280966)
879
880 9/2/05: Update: Changed all licenses in TSK to Common Public License
881 (except those that were already IBM Public License).
882
883 9/15/05: Bug Fix: The Unicode names would not be displayed if the FAT
884 short name entry was using code pages. The ASCII name check was removed,
885 which may lead to more false positives during inode_walk.
886
887 10/05/05: Update: improved the sector size check when the FAT boot
888 sector is read (check for specific values besides just mod 512).
889
890 10/12/05: Update: The ASCII name check was added back into FAT, but
891 the check no longer looks for values over 0x80.
892
893 10/12/05: Update: The inode_walk function in FAT skips clusters
894 that are allocated to files. This makes it much faster, but it
895 will now not find unallocated directory entries in the slack space
896 of allocated files.
897
898 10/13/05: Update: sorter updated to handle unicode in HTML output.
899
900 ---------------- VERSION 2.02 --------------
901 4/27/05: Bug Fix: the sizes of 'id' were not consistent in the
902 front-end and library functions for icat and ffind. Reported by
903 John Ward.
904
905 5/16/05: Bug Fix: fls could segfault in FAT if short name did not
906 exist. There was also a bug where the long file name variable
907 (fatfs->lfn_len) was not reset after processing a directory and the
908 next entry could incorrectly get the long name. Reported by Jaime
909 Chang. BUG: 1203673.
910
911 5/18/05: Update: Updated makedefs to support Darwin 8 (OS X Tiger)
912
913 5/23/05: Bug Fix: ntfs_dent_walk would not always stop when WALK_STOP
914 was returned. This caused some issues with previous versions of ifind.
915 This was fixed.
916
917 5/24/05: Bug Fix: Would not compile under Suse because it had header
918 file conflicts for the size of int64_t. Reported by: Andrea Ghirardini.
919 BUG: 1203676
920
921 5/25/05: Update: Fixed some memory leaks in fstools (reported by Jaime
922 Chang).
923
924 6/13/05: Update: Compiled with g++ to get better warning messages.
925 Fixed many signed versus unsigned comparisons, -1 assignments to
926 unsigned vars, and some other minor internal issues.
927
928 6/13/05: Bug Fix: if UFS or FFS found a valid dentry in unallocated
929 space, it could have a documented length that is larger than the
930 remaining unallocated space. This would cause an allocated name
931 to be skipped. BUG: 1210204 Reported by Christopher Betz.
932
933 6/13/05: Update: Improved design of all dent code so that there are no
934 more global variables.
935
936 6/13/05: Update: Improved design of FAT dent code so that FATFS_INFO
937 does not keep track of long file name information.
938
939 6/13/05: Bug Fix: If a cluster in a directory started with a strange
940 dentry, then FAT inode_walk would skip it. The fixis to make sure
941 that all directory sectors are processed. (BUG: 1203669). Reported
942 by Jaime Chang.
943
944 6/14/05: Update: Changed design of FS_INODE so that it contains the
945 inode address and the inode_walk action was changed to remove inum
946 as an argument.
947
948 6/15/05: Update: Added 'ils -o' back in as 'ils -O' to list open
949 and deleted files.
950
951 6/15/05: Update: Added '-m' flag to mactime so that it prints the month
952 as a number instead of its name.
953
954 7/2/05: Bug Fix: If an NTFS file did not have a $DATA or $IDX_*
955 attribute, then fls would not print it. The file had no content, but
956 the name should be shown. (BUG: 1231515) (Reported by Fuerst)
957
958
959 ---------------- VERSION 2.01 --------------
960 3/24/05: Bug Fix: ffind would fail if the directory had two
961 non-printable chars. The handling of non-printable chars was changed
962 to replace with '^.'. (BUG: 1170310) (reported by Brian Baskin)
963
964 3/24/05: Bug Fix: icat would not print the output to stdout when split
965 images were used. There was a bug in the image closing process of
966 icat. (BUG: 1170309) (reported by Brian Baskin)
967
968 3/24/05: Update: Changed the header files in fstools to make fs_lib.h
969 more self contained.
970
971 4/1/05: Bug Fix: Imgtools byte offset with many leading 0s could
972 cause issues. (BUG: 1174977)
973
974 4/1/05: Update: Removed test check in mmtools/dos.c for value cluster
975 size because to many partition tables have that as a valid field.
976 Now it checks only OEM name.
977
978 4/8/05: Update: Updated usage of 'strtoul' to 'strtoull' for blocks
979 and inodes.
980
981 ---------------- VERSION 2.00 --------------
982 1/6/05: Update: Added '-b' flag to 'mmls' so that sizes can be
983 printed in bytes. Suggested and a patch proposed by Matt Kucenski
984
985 1/6/05: Update: Define DADDR_T, INUM_T, OFF_T, PNUM_T as a static
986 size and use those to store values in data structures. Updated
987 print statements as well.
988
989 1/6/05: Update: FAT now supports larger images becuase the inode
990 address space is 64-bits.
991
992 1/6/05: Moved guess and get functions to misc from mmtools and
993 fstools.
994
995 1/7/05: Update: Added imgtools with support for "raw" and "split"
996 layers. All fstools have been updated.
997
998 1/7/05: Update: removed dtime from ils output
999
1000 1/9/05: Update: FAT code reads in clusters instead of sectors to
1001 be faster (suggested by David Collett)
1002
1003 1/9/05: Update: mmtools uses imgtools for split images etc.
1004
1005 1/10/05: Update: Removed usage of global variables when using
1006 file_walk internally.
1007
1008 1/10/05: Update: mmls BSD will use the next sector automatically
1009 if the wrong is given instead of giving an error.
1010
1011 1/10/05: Update: Updated file to version 4.12
1012
1013 1/11/05: Update: Added autodetect to file system tools.
1014
1015 1/11/05: Update: Changed names to specify file system type (not
1016 OS-based)
1017
1018 1/11/05: Update: Added '-t' option to fsstat to give just the type.
1019
1020 1/11/05: Update: Added autodetect to mmls
1021
1022 1/17/05: Update: Added the 'mmstat' tool that gives the type of
1023 volume system.
1024
1025 1/17/05: Update: Now using CVS for local version control - added
1026 date stamps to all files.
1027
1028 2/20/05: Bug Fix: ils / istat would go into an infinte loop if the
1029 attribute list had an entry with a length of 0. Reported by Angus
1030 Marshall (BUG: 1144846)
1031
1032 3/2/05: Update: non-printable letters in ExtX/UFS file names are
1033 now replaced by a '.'
1034
1035 3/2/05: Update: Made file system tools more library friendly by
1036 making stubs for each application.
1037
1038 3/4/05: Update: Redesigned the diskstat tool and created the
1039 disksreset tool to remove the HPA temporarily.
1040
1041 3/4/05: Update: Added imgstat tool that displays image format
1042 details
1043
1044 3/7/05: Bug Fix: In fsstat on ExtX, the final group would have an
1045 incorrect _percentage_ of free blocks value (although the actual
1046 number was correct). Reported by Knut Eckstein. (BUG: 1158620)
1047
1048 3/11/05: Update: Renamed diskstat, disksreset, sstrings, and imgstat to
1049 disk_stat, disk_sreset, srch_strings, and img_stat to make the names more
1050 clear.
1051
1052 3/13/05: Bug Fix: The verbose output for fatfs_file_walk had an
1053 incorrect sector address. Reported by Rudolph Pereira.
1054
1055 3/13/05: Bug Fix: The beta version had compiling problems on FreeBSD
1056 because of a naming clash with the new 'fls' functions. (reported
1057 by secman)
1058
1059
1060
1061 ---------------- VERSION 1.74 --------------
1062 11/18/04: Bug Fix: FreeBSD 5 would produce incorrect 'icat' output for
1063 Ext2/3 & UFS1 images because it used a 64-bit on-disk address.
1064 reported by neutrino neutrino. (BUG: 1068771)
1065
1066 11/30/04: Bug Fix: The makefile in disktools would generate an error
1067 on some systems (Cygwin) because of an extra entry. Reported by
1068 Vajira Ganepola (BUG: 1076029)
1069
1070
1071 ---------------- VERSION 1.73 --------------
1072 09/09/04: Update: Added journal support for EXT3FS and added jls
1073 and jcat tools.
1074
1075 09/13/04: Updated: Added the major and minor device numbers to
1076 EXTxFS istat.
1077
1078 09/13/04: Update: Added EXTxFS orphan code to 'fsstat'
1079
1080 09/24/04: Update: Fixed incorrect usage of 'ptr' and "" in action
1081 of ntfs_dent.c. Did not affect any code, but could have in the
1082 future. Reported by Pete Winkler.
1083
1084 09/25/04: Update: Added UFS flags to fsstat
1085
1086 09/26/04: Update: All fragments are printed for indirect block pointer
1087 addresses in UFS istat.
1088
1089 09/29/04: Update: Print extended UFS2 attributes in 'istat'
1090
1091 10/07/04: Bug Fix: Changed usage of (int) to (uintptr_t) for pointer
1092 arithmetic. Caused issues with Debian Sarge. (BUG: 1049352) - turned out
1093 to be from changes made to package version so that it would compile in
1094 64-bit system (BUG: 928278).
1095
1096 10/11/04: Update: Added diskstat to check for HPA on linux systems.
1097
1098 10/13/04: Update: Added root directory location to FAT32 fsstat output
1099
1100 10/17/04: Bug Fix: EXTxFS superblock location would not be printed
1101 for images in fsstat that did not have sparse superblok (which is
1102 rare) (BUG: 1049355)
1103
1104 10/17/04: Update: Added sigfind tool to find binary signatures.
1105
1106 10/27/04: Bug Fix: NTFS is_clust_alloc returned an error when loading
1107 $MFT that had attribute list entry. Now I assume that clusters
1108 referred to by the $MFT are allocated until the $MFT is loaded.
1109 (BUG: 1055862).
1110
1111 10/28/04: Bug Fix: Check to see if an attribute with the same name
1112 exists instead of relying on id only. (ntfs_proc_attrseq) Affects
1113 the processing of attribute lists. Reported by Szakacsits Szabolcs,
1114 Matt Kucenski, & Gene Meltser (BUG: 1055862)
1115
1116 10/28/04: Update: Removed usage of mylseek in fstools for all systems
1117 (Bug: 928278)
1118
1119
1120 ---------------- VERSION 1.72 --------------
1121 07/31/04: Update: Added flag to mft_lookup so that ifind can run in noabort
1122 mode and it will not stop when it finds an invalid magic value.
1123
1124 08/01/04: Update: Removed previous change and removed MAGIC check
1125 entirely. XP doesn't even care if the Magic is corrupt, so neither
1126 does TSK. The update sequence check should find an invalid MFT
1127 entry.
1128
1129 08/01/04: Update: Added error message to 'ifind' if none of the search
1130 options are given.
1131
1132 08/05/04: Bug Fix: Fixed g_curdirptr recursive error by clearing the value
1133 when dent_walk had to abort because a deleted directory could not be recovered.
1134 (BUG: 1004329) Reported by epsilon@yahoo.com
1135
1136 08/16/04: Update: Added a sanity check to fatfs.c fat2unixtime to check
1137 if the year is > 137 (which is the overflow date for the 32-bit UNIX time).
1138
1139 08/16/04: Update: Added first version of sstrings from binutils-2.15
1140
1141 08/20/04: Bug Fix: Fixed a bug where the group number for block 0 of an
1142 EXT2FS file system would report -1. 'dstat' no longer displays value when it
1143 is not part of a block group. (BUG: 1013227)
1144
1145 8/24/04: Update: If an attribute list entry is found with an invalid MFT
1146 entry address, then it is ignored instead of an error being generated and
1147 exiting.
1148
1149 8/26/04: Update: Changed internal design of NTFS to make is_clust_alloc
1150
1151 8/26/04: Update: If an attribute list entry is found with an invalid MFT
1152 entry address AND the entry is unallocated, then no error message is
1153 printed, it is just ignored or logged in verbose mode.
1154
1155 8/29/04: Update: Added support for 32-bit GID and UID in EXTxFS
1156
1157 8/30/04: Bug Fix: ntfs_dent_walk was adding 24 extra bytes to the
1158 size of the index record for the final record processing (calc of
1159 list_len) (BUG: 1019321) (reported and debugging help from Matt
1160 Kucenski).
1161
1162 8/30/04: Bug Fix: fs_data_lookup was using an id of 0 as a wild
1163 card, but 0 is a legit id value and this could cause confusion. To
1164 solve this, a new FS_FLAG_FILE_NOID flag was added and a new
1165 fs_data_lookup_noid function that will not use the id to lookup
1166 values. (BUG: 1019690) (reported and debugging help from Matt
1167 Kucenski)
1168
1169 8/30/04: Update: modified fs_data_lookup_noid to return unamed data
1170 attribute if that type is requested (instead of just relying on id
1171 value in attributes)
1172
1173 8/31/04: Update: Updated file to v4.10, which seems to fix the
1174 CYGWIN compile problem.
1175
1176 9/1/04: Update: Added more DOS partition types to mmls (submitted by
1177 Matt Kucenski)
1178
1179 9/2/04: Update: Added EXT3FS extended attributes and Posix ACL to istat
1180 output.
1181
1182 9/2/04: Update: Added free inode and block counts per group to fsstat for
1183 EXT2FS.
1184
1185 9/7/04: Bug Fix: FreeBSD compile error for PRIx printf stuff in mmtools/gpt.c
1186
1187
1188 ---------------- VERSION 1.71 --------------
1189 06/05/04: Update: Added sanity checks in fat to unix time conversion so that
1190 invalid times are set to 0.
1191
1192 06/08/04: Bug Fix: Added a type cast when size is assigned in FAT
1193 and removed the assignment to a 32-bit signed variable (which was no
1194 longer needed). (Bug: 966839)
1195
1196 06/09/04: Bug Fix: Added a type cast to the 'getuX' macros because some
1197 compilers were assuming it was signed (Bug: 966839).
1198
1199 06/11/04: Update: Changed NTFS magic check to use the aa55 at the
1200 end and fixed the name of the original "magic" value to oemname.
1201 The oemname is now printed in fsstat.
1202
1203 06/12/04: Bug Fix: The NTFS serial number was being printed with
1204 bytes in the wrong order in the fsstat output. (BUG: 972207)
1205
1206 06/12/04: Update: The begin offset value in index header for NTFS
1207 was 16-bits instead of 32-bits.
1208
1209 06/22/04: Update: Created a library for the MD5 and SHA1 functions so
1210 that it can be incorporated into other tools. Also renamed some of the
1211 indexing tools that hfind uses.
1212
1213 06/23/04: Update: Changed output of 'istat' for NTFS images. Added more
1214 data from $STANDARD_INFORMATION.
1215
1216 07/13/04: Update: Changed output of 'istat' for NTFS images again. Moved
1217 more data to the $FILE_NAME section and added new data.
1218
1219 07/13/04: Update: Changed code for processing NTFS runs and no
1220 longer check for the offset to be 0 in ntfs_make_data_run(). This
1221 could have prevented some sparse files from being processed.
1222
1223 07/13/04: Update: Added flags for compressed and encrypted NTFS
1224 files. They are not decrypted or uncompressed yet, just identified.
1225 They cannot be displayed from 'icat', but the known layout is given
1226 in 'istat'.
1227
1228 07/18/04: Bug Fix: Sometimes, 'icat' would report an error about an
1229 existing FILLER entry in an NTFS attribute. This was traced to
1230 instances when it was run on a non-base file record. There is now
1231 a check for that to not show the error. (BUG: 993459)
1232
1233 07/19/04: Bug Fix: A run of -1 may exist for sparse files in non-NT
1234 versions of NTFS. Changed check for this. reported by Matthew
1235 Kucenski. (BUG: 994024).
1236
1237 07/24/04: Bug Fix: NTFS attribute names were missing (rarely) on
1238 some files because the code assumed they would always be at offset
1239 64 for non-res attributes (Bug: 996981).
1240
1241 07/24/04: Update: Made listing of unallcoated NTFS file names less
1242 strict. There was a check for file name length versus stream length.
1243
1244 07/24/04: Update: Added $OBJECT_ID output to 'istat'
1245
1246 07/24/04: Update: Fixed ntfs.c compile warning about constant too
1247 large in time conversion code.
1248
1249 07/25/04: Update: Added attribute list contents to NTFS 'istat' output
1250
1251 07/25/04: Bug Fix: Not all slack space was being shown with 'dls -s'.
1252 It was documented that this occurs, but it is not what would be
1253 expected. (BUG: 997800).
1254
1255 07/25/04: Update: Changed output format of 'dls -s' so that it sends
1256 zeros where the file content was. Therefore the output is now a
1257 multiple of the data unit size. Also removed limitation to FAT &
1258 NTFS.
1259
1260 07/25/04: Update: 'dcalc' now has the '-s' option calculate the
1261 original location of data from a slack space image (dls -s).
1262 (from Chris Betz).
1263
1264 07/26/04: Update: Created the fs_os.h file and adjusted some of the
1265 header files for the PRI macros (C99). Created defines for OSes that do
1266 not have the macros already defined.
1267
1268 07/26/04: Non-release bug fix: Fixed file record size bug introduced with
1269 recent changes.
1270
1271 07/27/04: Update: Added GPT support to mmls.
1272
1273 07/29/04: Update: Added '-p' flag to 'ifind' to find deleted NTFS files
1274 that point to the given parent directory. Added '-l and -z' as well.
1275
1276
1277 ---------------- VERSION 1.70 --------------
1278 04/21/04: Update: Changed attribute and mode for FAT 'istat' so
1279 that actual FAT attributes are used instead of UNIX translation.
1280
1281 04/21/04: Update: The FAT 'istat' output better handles Long FIle
1282 Name entry
1283
1284 04/21/04: Update: The FAT 'istat' output better handles Volume Label
1285 entry
1286
1287 04/21/04: Update: Allowed the FAT volume label entry to be displayed
1288 with 'ils'
1289
1290 04/21/04: Update: Allowed the FAT volume label entry to be displayed
1291 with 'fls'
1292
1293 04/24/04: Update: 'dstat' on a FAT cluster now shows the cluster
1294 address in addition to the sector address.
1295
1296 04/24/04: Update: Added the cluster range to the FAT 'fsstat' output
1297
1298 05/01/04: Update: Improved the FAT version autodetect code.
1299
1300 05/02/04: Update: Removed 'H' flag from 'icat'.
1301
1302 05/02/04: Update: Changed all of the FS_FLAG_XXX variables in the
1303 file system tools to constants that are specific to the usage
1304 (NAME, DATA, META, FILE).
1305
1306 05/03/04: Update: fatfs_inode_walk now goes by sectors instead of clusters
1307 to get more dentries from slack space.
1308
1309 05/03/04: Bug Fix: The allocation status of FAT dentires was set only by
1310 the flag and not the allocation status of the cluster it is located in.
1311 (BUG: 947112)
1312
1313 05/03/04: Update: Improved comments and variable names in FAT code
1314
1315 05/03/04: Update: Added '-r' flag to 'icat' for deleted file recovery
1316
1317 05/03/04: Update: Added RECOVERY flag to file_walk for deleted file
1318 recovery
1319
1320 05/03/04: Update: Added FAT file recovery.
1321
1322 05/03/04: Update: Removed '-H' flag from 'icat'. Default is to
1323 display holes.
1324
1325 05/03/04: Update: 'fls -r' will recurse down deleted directories in FAT
1326
1327 05/03/04: Update: 'fsstat' reports FAT clusters that are marked as BAD
1328
1329 05/03/04: Update: 'istat' for FAT now shows recovery clusters for
1330 deleted files.
1331
1332 05/04/04: Update: Added output to 'fsstat' for FAT file systems by adding
1333 a list of BAD sectors and improving the amount of layout information. I
1334 also changed some of the internal variables.
1335
1336 05/08/04: Update: Removed addr_bsize from FS_INFO, moved block_frags
1337 to FFS_INFO, modified dcat output only data unit size.
1338
1339 05/20/04: Update: Added RECOVERY flag to 'ifind' so that it can find the
1340 data units that are allocated to deleted files
1341
1342 05/20/04: Update: Added icat recovery options to 'sorter'.
1343
1344 05/20/04: Update: Improved the naming convention in sorter for the 'ils'
1345 dead files.
1346
1347 05/21/04: Update: Added outlook to sorter rules (from David Berger)
1348
1349 05/27/04: Bug Fix: Added <linux/unistd.h> to mylseek.c so that it compiles
1350 with Fedora Core 2 (Patch by Angus Marshall) (BUG: 961908).
1351
1352 05/27/04: Update: Changed the letter with 'fls -l' for FIFO to 'p'
1353 instead of 'f' (reported by Dave Henkewick).
1354
1355 05/28/04: Update: Added '-u' flag to 'dcat' so that the data unit size
1356 can be specified for raw, swap, and dls image types.
1357
1358 05/28/04: Update: Changed the size argument of 'dcat' to be number of
1359 data units instead of size in bytes (suggestion by Harald Katzer).
1360
1361
1362 ---------------- VERSION 1.69 --------------
1363 03/06/04: Update: Fixed some memory leaks in ext2fs_close. reported
1364 by Paul Bakker.
1365 03/10/04: Bug Fix: If the '-s' flag was used with 'icat' on a EXT2FS
1366 or FFS file system, then a large amount of extra data came out.
1367 Reported by epsion. (BUG: 913874)
1368 03/10/04: Bug Fix: One of the verbose outputs in ext2fs.c was being sent
1369 to STDOUT instead of logfp. (BUG: 913875)
1370 04/14/04: Update: Added more data to fsstat output of FAT file system.
1371 04/15/04: Bug Fix: The last sector of a FAT file system may not
1372 be analyzed. (BUG: 935976)
1373 04/16/04: Update: Added full support for swap and raw by making the
1374 standard files and functions for them instead of the hack in dcat.
1375 Suggested by (and initial patch by) Paul Baker.
1376 04/18/04: Update: Changed error messages in EXT2/3FS code to be extXfs.
1377 04/18/04: Update: Updaged to version 4.09 of 'file'. This will
1378 help fix some of the problems people have had compiling it under
1379 OS X 10.3.
1380 04/18/04: Update: Added compiling support for SFU 3.5 (Microsoft). Patches
1381 from an anonymous person.
1382
1383
1384 ---------------- VERSION 1.68 --------------
1385 01/20/04: Bug Fix: FAT times were an hour too fast during daylight savings.
1386 Now use mktime() instead of manual calculation. Reported by Randall
1387 Shane. (BUG: 880606)
1388 02/01/04: Update: 'hfind -i' now reports the header entry as an invalid
1389 entry. The first header row was ignored.
1390 02/20/04: Bug Fix: indirect block pointer blocks would not be identified by
1391 the ifind tool. Reported by Knut Eckstein (BUG: 902709)
1392 03/01/04: Update: Added fs->seek_pos check to fs_read_random.
1393
1394 ---------------- VERSION 1.67 --------------
1395 11/15/03: Bug Fix: Added support for OS X 10.3 to src/makedefs. (BUG: 843029)
1396 11/16/03: Bug Fix: Mac partition tables could generate an error if there were
1397 VOID-type partitions. (BUG: 843366)
1398 11/21/03: Update: Changed NOABORT messages to verbose messages, so invalid
1399 data is not printed during 'ifind' searches.
1400 11/30/03: Bug Fix: icat would not hide the 'holes' if '-h' was given because
1401 the _UNALLOC flag was always being passed to file_walk. (reported by
1402 Knut Eckstein). (BUG: 851873)
1403 11/30/03: Bug Fix: NTFS data_walk was not using _ALLOC and _UNALLOC flags
1404 and other code that called it was not either. (BUG: 851895)
1405 11/30/03: Bug Fix: Not all needed commands were using _UNALLOC when they
1406 called file_walk (although for most cases it did not matter because
1407 sparse files would not be found in a directory for example). (Bug: 851897)
1408 12/09/03: Bug Fix: FFS and EXT2FS code was using OFF_T type instead of
1409 size_t for the size of the file. This could result in a file > 2GB
1410 as being a negative size on some systems (BUG: 856957).
1411 12/26/03: Bug Fix: ffind would crash for root directory of FAT image.
1412 Added NULL check and added a NULL name to fake root directory entry.
1413 (BUG: 871219)
1414 01/05/04: Bug Fix: The clustcnt value for FAT was incorrectly calculated
1415 and was too large for FAT12 and FAT16 by 32 sectors. This could produce
1416 extra entries in the 'fsstat' output when the FAT is dumped.
1417 (BUG: 871220)
1418 01/05/04: Bug Fix: ils, fls, and istat were not printing the full size
1419 of files that are > 2GB. (reported by Knut Eckstein) (BUG: 871457)
1420 01/05/04: Bug Fix: The EXT2FS and EXT3FS code was not using the
1421 i_dir_acl value as the upper 32-bits of regular files that are
1422 > 2GB (BUG: 871458)
1423 01/06/04: Mitigation: An error was reported where sorter would error
1424 that icat was being passed a '-1' argument. I can't find how that would
1425 happen, so I added quotes to all arguments so that the next time it
1426 occurs, the error is more useful (BUG: 845840).
1427 01/06/04: Update: Incorporated patch from Charles Seeger so that 'cc'
1428 can be used and compile time warnings are fixed with Sun 'cc'.
1429 01/06/04: Update: Upgraded file from v3.41 to v4.07
1430
1431
1432 ---------------- VERSION 1.66 --------------
1433 09/02/03: Bug Fix: Would not compile under OpenBSD 3 because fs_tools.h
1434 & mm_tools was missing a defined statment (reported by Randy - m0th_man)
1435 NOTE: Bugs now will have an entry into the Source Forge bug tracking
1436 sytem.
1437 10/13/03: Bug Fix: buffer was not being cleared between uses and length
1438 incorrectly set in NTFS resulted in false deleted file names being shown
1439 when the '-r' flag was given. The extra entries were from the previous
1440 directory. (BUG: 823057)
1441 10/13/03: Bug Fix: The results of 'sorter' varied depending on the version
1442 of Perl and the system. If the file output matched more than one,
1443 sorter could not gaurantee which would match. Therefore, results were
1444 different for some files and some machines. 'sorter' now enforces the
1445 ordering based on the order they are in the configuration file. The
1446 entries at the end of the file have priority over the first entries
1447 (generic rules to specific rules). (BUG: 823057)
1448 10/14/03: Update: 'mmls' prints 'MS LVM' with partition type 0x42 now.
1449 10/25/03: Bug Fix: NTFS could have a null pointer crash if the image
1450 was very corrupt and $Data was not found for the MFT.
1451 11/10/03: Bug Fix: NTFS 'ffind' would only report the file name and not
1452 the attribute name because the type and id were ignored. ffind and
1453 ntfs_dent were updated - found during NTFS keyword search test.
1454 (Bug: 831579()
1455 11/12/03: Update: added support for Solaris x86 partition tables to 'mmls'
1456 11/12/03: Update: Modified the sparc data structure to add the correct
1457 location of the 'sanity' magic value.
1458 11/15/03: Update: Added '-s' flag to 'icat' so that slack space is also
1459 displayed.
1460
1461 ---------------- VERSION 1.65 --------------
1462 08/03/03: Bug Fix: 'sorter' now checks for inode values that are too
1463 small to avoid 'icat' errors about invalid inode values.
1464 08/19/03: Update: 'raw' is now a valid type for 'dcat'.
1465 08/21/03: Update: mactime and sorter look for perl5.6.0 first.
1466 08/21/03: Update: Removed NSRL support from 'sorter' until a better
1467 wany to identify the known good and known bad files is found
1468 08/21/03: Bug Fix: The file path replaces < and > with HTML
1469 encoding for HTML output (ils names were not being shown)
1470 08/25/03: Update: Added 'nsrl.txt' describing why the NSRL functionality
1471 was removed.
1472 08/27/03: Update: Improved code in 'mactime' to reduce warnings when
1473 '-w' is used with Perl ('exists' checks on arrays).
1474 08/27/03: Update: Improved code in 'sorter' to reduce warnings when
1475 '-w' is used with Perl (inode_int for NTFS).
1476
1477 ---------------- VERSION 1.64 --------------
1478 08/01/03: Docs Fix: The Sun VTOC was documented as Virtual TOC and it
1479 should be Volume TOC (Jake @ UMASS).
1480 08/02/03: Bug Fix: Some compilers complained about verbose logging
1481 assignment in 'mmls' (Ralf Spenneberg).
1482
1483 ---------------- VERSION 1.63 --------------
1484 06/13/03; Update: Added 'mmtools' directory with 'dos' partitions
1485 and 'mmls'.
1486 06/18/03: Update: Updated the documents in the 'doc' directory
1487 06/19/03: Update: Updated error message for EXT3FS magic check
1488 06/27/03: Update: Added slot & table number to mmls
1489 07/08/03: Update: Added mac support to mmtools
1490 07/11/03: Bug Fix: 'sorter' was not processing all unallocated meta
1491 data structures because of a regexp error. (reported by Jeff Reava)
1492 07/16/03: Update: Added support for FreeBSD5
1493 07/16/03: Update: Added BSD disk labels to mmtools
1494 07/28/03: Update: Relaxed requirements for DOS directory entries, the wtime
1495 can be zero (reported by Adam Uccello).
1496 07/30/03: Update: Added SUN VTOC to mmtools
1497 07/31/03: Update: Added NetBSD support (adam@monkeybyte.org)
1498 08/01/03: Update: Added more sanity checks to FAT so that it would not
1499 try and process NTFS images that have the same MAGIC value
1500
1501 ---------------- VERSION 1.62 --------------
1502 04/11/03: Bug Fix: 'fsstat' for an FFS file system could report data
1503 fragments in the last group that were larger than the maximum
1504 fragment
1505 04/11/03: Bug Fix: 'ffs' allows the image to not be a multiple of the
1506 block size. A read error occured when it tried to read the last
1507 fragments since a whole block could not be read.
1508 04/15/03: Update: Added debug statements to FAT code.
1509 04/26/03: Update: Added verbose statements to FAT code
1510 04/26/03: Update: Added NOABORT flag to dls -s
1511 04/26/03: Update: Added stderr messages for errors that are not aborted
1512 because of NOABORT
1513 05/27/03: Update: Added 'mask' field to FATFS_INFO structure and changed
1514 code in fatfs.c to use it.
1515 05/27/03: Update: isdentry now checks the starting cluster to see if
1516 it is a valid size.
1517 05/27/03: Bug Fix: Added a sanitizer to 'sorter' to remove invalid chars
1518 from the 'file' output and reduce the warnings from Perl.
1519 05/28/03: Bug Fix: Improved sanitize expression in 'sorter'
1520 05/28/03: Update: Added '-d' option to 'mactime' to allow output to be
1521 given in comma delimited format for importing into a spread sheet or
1522 other graphing tool
1523 06/09/03: Update: Added hourly summary / indexing to mactime
1524 06/09/03: Bug Fix: sorter would not allow linux-ext3 fstype
1525
1526
1527 ---------------- VERSION 1.61 --------------
1528 02/05/03: Update: Started addition of image thumbnails to sorter
1529 03/05/03: Update: Updated 'file' to version 3.41
1530 03/16/03: Update: Added comments and NULL check to 'ifind'
1531 03/16/03: Bug Fix: Added a valid magic of 0 for MFT entries. This was
1532 found in an XP image.
1533 03/26/03: Bug Fix: fls would crash for an inode of 0 and a clock skew
1534 was given. fixed the bug in fls.c (debug help from Josep Homs)
1535 03/26/03: Update: Added more verbose comments to ntfs_dent.c.
1536 03/26/03: Bug Fix: 'ifind' for a path could return a result that was
1537 shorter than the requested name (strncmp was used)
1538 03/26/03: Update: Short FAT names can be used in 'ifind -n' and
1539 error messages were improved
1540 03/26/03: Bug Fix: A final NTFS Index Buffer was not always processed in
1541 ntfs_dent.c, which resulted in files not being shown. This was fixed
1542 with debugging help from Matthew Shannon.
1543 03/27/03: Update: Added an 'index.html' for image thumbnails in sorter
1544 and added a 'details' link from the thumbnail to the images.html file
1545 03/27/03: Update: 'sorter' can now take a directory inode to start
1546 processing
1547 03/27/03: Update: added '-z' flag when running 'file' in 'sorter' so that
1548 compressed file contents are reported
1549 03/27/03: Update: added '-i' flag to 'mactime' that creates a daily
1550 summary of events
1551 03/27/03: Update: Added support for Version 2 of the NSRL in 'hfind'
1552 04/01/03: Update: Added support for Hash Keeper to 'hfind'
1553 04/01/03: Update: Added '-e' flag to 'hfind' for extended info
1554 (currently hashkeeper only)
1555
1556
1557 ---------------- VERSION 1.60 --------------
1558 10/31/02: Bug Fix: the unmounting status of EXT2FS in the 'fsstat' command
1559 was not correct (reported by Stephane Denis).
1560 11/24/02: Bug Fix: The -v argument was not allowed on istat or fls (Michael
1561 Stone)
1562 11/24/02: Bug Fix: When doing an 'ifind' on a UNIX fs, it could abort if it
1563 looked at an unallocated inode with invalid indirect block pointers.
1564 This was fixed by adding a "NOABORT" flag to the walk code and adding
1565 error checks in the file system code instead of relying on the fs_io
1566 code. (suggested by Micael Stone)
1567 11/26/02: Update: ifind has a '-n' argument that allows one to specify a
1568 file name it and it searches to find the meta data structure for it
1569 (suggested by William Salusky).
1570 11/26/02: Update: Now that there is a '-n' flag with 'ifind', the '-d'
1571 flag was added to specify the data unit address. The old syntax of
1572 giving the data_unit at the end is no longer supported.
1573 11/27/02: Update: Added sanity checks on meta data and data unit addresses
1574 earlier in the code.
1575 12/12/02: Update: Added additional debug statements to NTFS code
1576 12/19/02: Update: Moved 'hash' directory to 'hashtools'
1577 12/19/02: Update: Started development of 'hfind'
1578 12/31/02: Update: Improved verbose debug statements to show full 64-bit
1579 offsets
1580 01/02/03: Update: Finished development of 'hfind' with ability to update
1581 for next version of NSRL (which may have a different format)
1582 01/05/03: Bug Fix: FFS and EXT2FS symbolic link destinations where not
1583 properly NULL terminated and some extra chars were appended in 'fls'
1584 (later reported by Thorsten Zachmann)
1585 01/06/03: Bug Fix: getu64() was not properly masking byte sizes and some
1586 data was being lost. This caused incorrect times to be displayed in some
1587 NTFS files.
1588 01/06/03: Bug Fix: ifind reported incorrect ownership for some UNIX
1589 file systems if the end fragments were allocated to a different file than
1590 the first ones were.
1591 01/07/03: Update: Renamed the src/mactime directory to src/timeline.
1592 01/07/03: Update: Updated README and man pages for hfind and sorter
1593 01/12/03: Bug Fix: ntfs_mft_lookup was casting a 64-bit value to a 32-bit
1594 variable. This caused MFT Magic errors. Reported and debugged by
1595 Keven Murphy
1596 01/12/03: Update: Added verbose argument to 'fls'
1597 01/12/03: Bug Fix: '-V' argument to 'istat' was doing verbose instead of
1598 version
1599 01/13/03: Update: Changed static sizes of OFF_T and DADDR_T in Linux
1600 version to the actual 'off_t' and 'daddr_t' types
1601 01/23/03: Update: Changed use of strtok_r to strtok in ifind.c so that
1602 Mac 10.1 could compile (Dave Goldsmith).
1603 01/28/03: Update: Improved code in 'hfind' and 'sorter' to handle
1604 files with spaces in the path (Dave Goldsmith).
1605
1606 ---------------- VERSION 1.52 --------------
1607 09/24/02: Bug Fix: Memory leak in ntfs_dent_idxentry(), ntfs_find_file(),
1608 and ntfs_dent_walk()
1609 09/24/02: Update: Removal of index sequences for index buffers is now
1610 done using upd_off, which will allow for NTFS to move the structure in
1611 the future.
1612 09/26/02: Update: Added create time for NTFS / STANDARD_INFO to
1613 istat output.
1614 09/26/02: Update: Changed the method that the NTFS time is converted
1615 to UNIX time. Should be more effecient.
1616 10/09/02: Update: dcat error changed.
1617 10/02/02: Update: Includes a Beta version of 'sorter'
1618
1619
1620 ---------------- VERSION 1.51 --------------
1621 09/10/02: Bug Fix: Fixed a design bug that would not allow attribute
1622 lists in $MFT. This bug would generate an error that complained about
1623 an invalid MFT entry in attribute list.
1624 09/10/02: Update: The size of files and directories is now calculated
1625 after each time proc_attrseq() is called so that it is more up to date
1626 when dealing with attribute lists. The size has the sizes of all
1627 $Data, $IDX_ROOT, and $IDX_ALLOC streams.
1628 09/10/02: Update: The maxinum number of MFT entries is now calculated
1629 each time an MFT entry is processed while loading the MFT. This
1630 allows us to reflect what the maximum possible MFT entry is at that
1631 given point based on how many attribute lists have been processed.
1632 09/10/02: Update: Added file version 3.39 to distro (bigger magic files)
1633 (Salusky)
1634 09/10/02: Bug Fix: fs_data was wasting memory when it was allocated
1635 09/10/02: Update: added a fs_data_alloc() function
1636 09/12/02: Bug Fix: Do not give an error if an attribute list of an
1637 unallocated file points to an MFT that no longer claims it is a
1638 member of the list.
1639 09/12/02: Update: No longer need version to remove update sequence
1640 values from on-disk buffers
1641 09/19/02: Bug Fix: fixed memory leak in ntfs_load_ver()
1642 09/19/02: Bug Fix: Update sequence errors were displayed because of a
1643 bug that occured when an MFT entry crossed a run in $MFT. Only occured
1644 with 512-byte clusters and an odd number of clusters in a run.
1645 09/19/02: Update: New argument to ils, istat, and fls that allows user to
1646 specify a time skew in seconds of the compromised system. Originated
1647 from discussion at DFRWS II.
1648 09/19/02: Update: Added '-h' argument to mactime to display header info
1649
1650 ---------------- VERSION 1.50 --------------
1651
1652 04/21/02: icat now displays idxroot attribute for NTFS directories
1653 04/21/02: fs_dent_print functions now are passed the FS_DATA structure
1654 instead of the extra inode and name strings. (NTFS)
1655 04/21/02: fs_dent_print functions display alternate data stream size instead
1656 of the default data size (NTFS)
1657 04/24/02: Fixed bug in istat that displayed too many fragments with ffs images
1658 04/24/02: Fixed bug in istat that did not display sparse files correctly
1659 04/24/02: fsstat of FFS images now identifies the fragments at the
1660 beginning of cyl groups as data fragments.
1661 04/26/02: Fixed bug in ext2fs_dent_parse_block that did not advance the
1662 directory entry pointer far enough each time
1663 04/26/02: Fixed bug in ext2fs_dent_parse_block so that gave an error if
1664 a file name was exactly 255 chars
1665 04/29/02: Removed the getX functions from get.c as they are now macros
1666 05/11/02: Added support for lowercase flag in FAT
1667 05/11/02: Added support for sequence values (NTFS)
1668 05/13/02: Added FS_FLAG_META for FAT
1669 05/13/02: Changed ifind so that it looks the block up to identify if it is
1670 a meta data block when an inode can not be found
1671 05/13/02: Added a conditional to ifind so that it handles sparse files better
1672 05/19/02: Changed icat so that the default attribute type is set in the
1673 file_walk function
1674 05/20/02: ils and dls now use boundary inode & block values if too large
1675 or small are given
1676 05/21/02: istat now displays all NTFS times
1677 05/21/02: Created functions to just display date and time
1678 05/24/02: moved istat functionality to the specific file system file
1679 05/25/02: added linux-ext3 flag, but no new features
1680 05/25/02: Added sha1 (so Autopsy can use the NIST SW Database)
1681 05/26/02: Fixed bug with FAT that did not return all slack space on file_walk
1682 05/26/02: Added '-s' flag to dls to extract slack space of FAT and NTFS
1683 06/07/02: fixed _timezone variable so correct times are shown in CYGWIN
1684 06/11/02: *_copy_inode now sets the flags for the inode
1685 06/11/02: fixed bug in mactimes that displayed a duplicate entry with time
1686 because of header entries in body file
1687 06/12/02: Added ntfs.README doc
1688 06/16/02: Added a comment to file Makefile to make it easier to compile for
1689 an IR CD.
1690 06/18/02: Fixed NTFS bug that showed ADS when only deleted files were supposed
1691 to be shown (when ADS in directory)
1692 06/19/02: added the day of the week to the mactime output (Tan)
1693 07/09/02: Fixed bug that added extra chars to end of symlink destination
1694 07/17/02: 1.50 Released
1695
1696
1697
1698 ---------------- VERSION 1.00 --------------
1699 - Integrated TCT-1.09 and TCTUTILs-1.01
1700 - Fixed bug in bcat if size is not given with type of swap.
1701 - Added platform indep by including the structures of each file system type
1702 - Added flags for large file support under linux
1703 - blockcalc was off by 1 if calculated using the raw block number and
1704 not the one that lazarus spits out (which start at 1)
1705 - Changed the inode_walk and block_walk functions slightly to return a
1706 value so that a walk can be ended in the middle of it.
1707 - FAT support added
1708 - Improved ifind to better handle fragments
1709 - '-z' flag to fls and istat now use the time zone string instead of
1710 integer value.
1711 - no longer prepend / in _dent
1712 - verify that '-m' directory in fls ends with a '/'
1713 - identify the destination of sym links
1714 - fsstat tool added
1715 - fixed caching bug with FAT12 when the value overlapped cache entries
1716 - added mactime
1717 - removed the <inode> value in fls when printing mac format (inode is now printed in mactime)
1718 - renamed src/misc directory to src/hash (it only has md5 and will have sha)
1719 - renamed aux directory to misc (Windows doesn't allow aux as a name ??)
1720 - Added support for Cygwin
1721 - Use the flags in super block of EXT2FS to identify v1 or v2
1722 - removed file system types of linux1 and linux2 and linux
1723 - added file system type of linux-ext2 (as ext3 is becoming more popular)
1724 - bug in file command that reported seek error for object files and STDIN
Something went wrong with that request. Please try again.