CVS commit: wip/sleuthkit/patches

[Thomas Klausner <thomasklausner%users.sourceforge.net@localhost>]

Module name:    wip
Committed by:   thomasklausner
Date:           Wed Jul  5 16:44:35 UTC 2006

Added Files:
        wip/sleuthkit/patches: patch-ac patch-ad patch-ae

Log Message:
Complete update to 2.04.
Changes:

---------------- VERSION 2.04 --------------
12/1/05: Bug Fix: Fixed a bug in the verbose output of img_open
that would crash if no type or offset was given.  Reported and
patched by Wyatt Banks.

12/20/05: Bug Fix: An NTFS directory index sanity check used 356
instead of 365 when calculating an upper bound on the times.  Reported
by Wyatt Banks.

12/23/05: Bug Fix: Two printf statements in istat for NTFS printed
to stdout instead of a specific file handle. Reported by Wyatt
Banks.

1/22/06: Bug Fix: fsstat, imgstat and dcalc were using a char instead
of int for the return value of getopt, which caused some systems to not
execute the programs. (internal fix and later reported by Bernhard Reiter)

2/23/06: Update: added support for FreeBSD 6.

2/27/06: Bug Fix: Indirect blocks would nto be found by ifind with
UFS and Ext2.  Reported by Nelson G. Mejias-Diaz.  (BUG: 1440075)

3/9/06: Update: Added AFF image file support.

3/14/06: Bug Fix: If the first directory entry of a UFS or ExtX block
was unallocated, then later entries may not be shown. Reported by John
Langezaal.  (BUG: 1449655)

4/3/06: Update: Finished the improved error handling.  Many internal
changes, not many external changes.  error() function no longer used
and instead tsk_err variables and function are used.  This makes the
library more powerful.

4/5/06: Update: The byte offset for a volume is now passed to the mm_
and fs_ functions instead of img_open.  This allows img_info to be used
for multiple volumes at the same time. This required some mm_ changes.

4/5/06: Update: All TSK libraries are written to the lib directory.

4/6/06: Update: Added FS_FLAG_DATA_RES flag to identify data that are
resident in ntfs_data_walk (suggested by Michael Cohen).

4/6/06: Update: The partition code (media Management) now checks that a
partition starts before the end of the image file.  There are currently
no checks about the end of the partition though.

4/6/06: Update: The media management code now shows unpartitioned space
as such from the end of the last partition to the end of the image file
(using the image file size).  (Suggested by Wyatt Banks).

4/7/06: Update: New version of ISO9660 code from Wyatt Banks and Crucial
Security added and other code updated to allow CDs to be analyzed.

4/7/06: There was a conflict with guessuXX with mmtools and fstools.
Renamed to mm_guessXX and fs_guessXX.

4/10/06: Upgraded AFFLIB to 1.5.6

4/12/06: Added version of libewf and support for it in imgtools

4/13/06: Added new img_cat tool to extract raw data from an image format.

4/24/06: Upgraded AFFLIB to 1.5.12

4/24/06: split and raw check if the image is a directory 

4/24/06: Updated libewf to 20060423-1

4/26/06: Updated makedefs to work with SunOS 5.10

5/3/06: Added iso9660 patch from Wyatt Banks so that version number
is not printed with file name.

5/4/06: Updated error checking in icat, istat, fatfs_dent, and ntfs_dent

5/8/06: Updated libewf to 20060505-1 to fix some gcc 2 compile errors.

5/9/06: Updated AFFLIB to 1.6.18

5/11/06: Cleaned up error handling (removed %m and unused legacy code)

5/11/06: Updated AFFLIB to 1.6.23

---------------- VERSION 2.03 --------------
7/26/05: Update: Removed incorrect print_version() statement from
fs_tools.h (reported by Jaime Chang)

7/26/05: Update: Renamed libraries to start with "lib"

7/26/05: Update: Removed the logfp variable for verbose statements
and instead use only stderr.

8/12/05: Update: If time is 0, then it is put as 00:00:00 instead of
the default 1970 or 1980 time. 

8/13/05: Update: Added Unicode support for FAT and NTFS (Supported by
I.D.E.A.L. Technology Corp).

9/2/05: Update: Added Unicode support for UFS and ExtX.  Non-printable
ASCII characters are no longer replaced with '^.'.  

9/2/05: Update: Improved the directory entry sanity checks for UFS
and ExtX.

9/2/05: Update: Upgraded file to version 4.15.

9/2/05: Update: The dent_walk code of all file systems does not
abort if a sub-directory is encountered with an error.  If it is the
top directory explicitly called, then it still gives an error.

9/2/05: Bug Fix: MD5 and SHA-1 values were incorrect under AMD64 
systems because the incorrect variable sizes were being used.
(reported by: Regis Friend Cassidy. BUG: 1280966)

9/2/05: Update: Changed all licenses in TSK to Common Public License
(except those that were already IBM Public License).

9/15/05: Bug Fix: The Unicode names would not be displayed if the FAT
short name entry was using code pages.  The ASCII name check was removed,
which may lead to more false positives during inode_walk.

10/05/05: Update: improved the sector size check when the FAT boot
sector is read (check for specific values besides just mod 512).

10/12/05: Update: The ASCII name check was added back into FAT, but
the check no longer looks for values over 0x80.

10/12/05: Update: The inode_walk function in FAT skips clusters
that are allocated to files.  This makes it much faster, but it
will now not find unallocated directory entries in the slack space
of allocated files.

10/13/05: Update: sorter updated to handle unicode in HTML output.

---------------- VERSION 2.02 --------------
4/27/05: Bug Fix: the sizes of 'id' were not consistent in the
front-end and library functions for icat and ffind.  Reported by
John Ward.

5/16/05: Bug Fix: fls could segfault in FAT if short name did not
exist.  There was also a bug where the long file name variable
(fatfs->lfn_len) was not reset after processing a directory and the
next entry could incorrectly get the long name.  Reported by Jaime
Chang.  BUG: 1203673.

5/18/05: Update: Updated makedefs to support Darwin 8 (OS X Tiger)

5/23/05: Bug Fix: ntfs_dent_walk would not always stop when WALK_STOP
was returned.  This caused some issues with previous versions of ifind.
This was fixed.

5/24/05: Bug Fix: Would not compile under Suse because it had header
file conflicts for the size of int64_t. Reported by: Andrea Ghirardini.
BUG: 1203676

5/25/05: Update: Fixed some memory leaks in fstools (reported by Jaime
Chang).

6/13/05: Update: Compiled with g++ to get better warning messages.
Fixed many signed versus unsigned comparisons, -1 assignments to
unsigned vars, and some other minor internal issues.

6/13/05: Bug Fix: if UFS or FFS found a valid dentry in unallocated
space, it could have a documented length that is larger than the
remaining unallocated space.  This would cause an allocated name
to be skipped.  BUG: 1210204  Reported by Christopher Betz.

6/13/05: Update: Improved design of all dent code so that there are no 
more global variables.  

6/13/05: Update: Improved design of FAT dent code so that FATFS_INFO
does not keep track of long file name information.

6/13/05: Bug Fix: If a cluster in a directory started with a strange
dentry, then FAT inode_walk would skip it.  The fixis to make sure
that all directory sectors are processed.  (BUG: 1203669).  Reported
by Jaime Chang.

6/14/05: Update: Changed design of FS_INODE so that it contains the
inode address and the inode_walk action was changed to remove inum
as an argument.

6/15/05: Update: Added 'ils -o' back in as 'ils -O' to list open
and deleted files.

6/15/05: Update: Added '-m' flag to mactime so that it prints the month
as a number instead of its name.

7/2/05: Bug Fix: If an NTFS file did not have a $DATA or $IDX_*
attribute, then fls would not print it.  The file had no content, but
the name should be shown.  (BUG: 1231515) (Reported by Fuerst)


---------------- VERSION 2.01 --------------
3/24/05: Bug Fix: ffind would fail if the directory had two
non-printable chars.  The handling of non-printable chars was changed
to replace with '^.'.  (BUG: 1170310) (reported by Brian Baskin)

3/24/05: Bug Fix: icat would not print the output to stdout when split
images were used.  There was a bug in the image closing process of
icat.  (BUG: 1170309) (reported by Brian Baskin)

3/24/05: Update: Changed the header files in fstools to make fs_lib.h
more self contained.

4/1/05: Bug Fix: Imgtools byte offset with many leading 0s could
cause issues.  (BUG: 1174977)

4/1/05: Update: Removed test check in mmtools/dos.c for value cluster
size because to many partition tables have that as a valid field.
Now it checks only OEM name.

4/8/05: Update: Updated usage of 'strtoul' to 'strtoull' for blocks
and inodes.

---------------- VERSION 2.00 --------------
1/6/05: Update: Added '-b' flag to 'mmls' so that sizes can be
printed in bytes.  Suggested and a patch proposed by Matt Kucenski

1/6/05: Update: Define DADDR_T, INUM_T, OFF_T, PNUM_T as a static
size and use those to store values in data structures.   Updated
print statements as well.

1/6/05: Update: FAT now supports larger images becuase the inode
address space is 64-bits.

1/6/05: Moved guess and get functions to misc from mmtools and
fstools.

1/7/05: Update: Added imgtools with support for "raw" and "split"
layers.  All fstools have been updated.

1/7/05: Update: removed dtime from ils output

1/9/05: Update: FAT code reads in clusters instead of sectors to
be faster (suggested by David Collett)

1/9/05: Update: mmtools uses imgtools for split images etc.

1/10/05: Update: Removed usage of global variables when using
file_walk internally.

1/10/05: Update: mmls BSD will use the next sector automatically
if the wrong is given instead of giving an error.

1/10/05: Update: Updated file to version 4.12

1/11/05: Update: Added autodetect to file system tools.

1/11/05: Update: Changed names to specify file system type (not
OS-based)

1/11/05: Update: Added '-t' option to fsstat to give just the type.

1/11/05: Update: Added autodetect to mmls

1/17/05: Update: Added the 'mmstat' tool that gives the type of
volume system.

1/17/05: Update: Now using CVS for local version control - added
date stamps to all files.

2/20/05: Bug Fix: ils / istat would go into an infinte loop if the
attribute list had an entry with a length of 0.  Reported by Angus
Marshall (BUG: 1144846)

3/2/05: Update: non-printable letters in ExtX/UFS file names are
now replaced by a '.'

3/2/05: Update: Made file system tools more library friendly by 
making stubs for each application.

3/4/05: Update: Redesigned the diskstat tool and created the
disksreset tool to remove the HPA temporarily.

3/4/05: Update: Added imgstat tool that displays image format
details

3/7/05: Bug Fix: In fsstat on ExtX, the final group would have an
incorrect _percentage_ of free blocks value (although the actual
number was correct).  Reported by Knut Eckstein.  (BUG: 1158620)

3/11/05: Update: Renamed diskstat, disksreset, sstrings, and imgstat to
disk_stat, disk_sreset, srch_strings, and img_stat to make the names more
clear. 

3/13/05: Bug Fix: The verbose output for fatfs_file_walk had an
incorrect sector address.  Reported by Rudolph Pereira.

3/13/05: Bug Fix: The beta version had compiling problems on FreeBSD
because of a naming clash with the new 'fls' functions. (reported
by secman)



---------------- VERSION 1.74 --------------
11/18/04: Bug Fix: FreeBSD 5 would produce incorrect 'icat' output for
Ext2/3 & UFS1 images because it used a 64-bit on-disk address. 
reported by neutrino neutrino.  (BUG: 1068771)

11/30/04: Bug Fix: The makefile in disktools would generate an error
on some systems (Cygwin) because of an extra entry.  Reported by
Vajira Ganepola (BUG: 1076029)


---------------- VERSION 1.73 --------------
09/09/04: Update: Added journal support for EXT3FS and added jls
and jcat tools.

09/13/04: Updated: Added the major and minor device numbers to
EXTxFS istat.

09/13/04: Update: Added EXTxFS orphan code to 'fsstat'

09/24/04: Update: Fixed incorrect usage of 'ptr' and "" in action
  of ntfs_dent.c.  Did not affect any code, but could have in the
  future.  Reported by Pete Winkler.

09/25/04: Update: Added UFS flags to fsstat

09/26/04: Update: All fragments are printed for indirect block pointer
  addresses in UFS istat.

09/29/04: Update: Print extended UFS2 attributes in 'istat'

10/07/04: Bug Fix: Changed usage of (int) to (uintptr_t) for pointer
arithmetic. Caused issues with Debian Sarge. (BUG: 1049352) - turned out
to be from changes made to package version so that it would compile in
64-bit system (BUG: 928278).

10/11/04: Update: Added diskstat to check for HPA on linux systems.

10/13/04: Update: Added root directory location to FAT32 fsstat output

10/17/04: Bug Fix: EXTxFS superblock location would not be printed
for images in fsstat that did not have sparse superblok (which is
rare)  (BUG: 1049355)

10/17/04: Update: Added sigfind tool to find binary signatures.

10/27/04: Bug Fix: NTFS is_clust_alloc returned an error when loading
  $MFT that had attribute list entry.  Now I assume that clusters 
  referred to by the $MFT are allocated until the $MFT is loaded.
  (BUG: 1055862).

10/28/04: Bug Fix: Check to see if an attribute with the same name
  exists instead of relying on id only. (ntfs_proc_attrseq) Affects
  the processing of attribute lists.  Reported by Szakacsits Szabolcs,
  Matt Kucenski, & Gene Meltser (BUG: 1055862)

10/28/04: Update: Removed usage of mylseek in fstools for all systems
  (Bug: 928278)


---------------- VERSION 1.72 --------------
07/31/04: Update: Added flag to mft_lookup so that ifind can run in noabort
mode and it will not stop when it finds an invalid magic value.

08/01/04: Update: Removed previous change and removed MAGIC check
entirely.  XP doesn't even care if the Magic is corrupt, so neither
does TSK.  The update sequence check should find an invalid MFT
entry.

08/01/04: Update: Added error message to 'ifind' if none of the search
options are given.

08/05/04: Bug Fix: Fixed g_curdirptr recursive error by clearing the value
when dent_walk had to abort because a deleted directory could not be recovered.
(BUG:  1004329)  Reported by epsilon%yahoo.com@localhost

08/16/04: Update: Added a sanity check to fatfs.c fat2unixtime to check
if the year is > 137 (which is the overflow date for the 32-bit UNIX time).

08/16/04: Update: Added first version of sstrings from binutils-2.15

08/20/04: Bug Fix: Fixed a bug where the group number for block 0 of an 
EXT2FS file system would report -1. 'dstat' no longer displays value when it
is not part of a block group. (BUG: 1013227)

8/24/04: Update: If an attribute list entry is found with an invalid MFT
entry address, then it is ignored instead of an error being generated and
exiting.

8/26/04: Update: Changed internal design of NTFS to make is_clust_alloc

8/26/04: Update: If an attribute list entry is found with an invalid MFT
entry address AND the entry is unallocated, then no error message is 
printed, it is just ignored or logged in verbose mode.

8/29/04: Update: Added support for 32-bit GID and UID in EXTxFS

8/30/04: Bug Fix: ntfs_dent_walk was adding 24 extra bytes to the
size of the index record for the final record processing (calc of
list_len) (BUG: 1019321) (reported and debugging help from Matt
Kucenski).

8/30/04: Bug Fix: fs_data_lookup was using an id of 0 as a wild
card, but 0 is a legit id value and this could cause confusion.  To
solve this, a new FS_FLAG_FILE_NOID flag was added and a new
fs_data_lookup_noid function that will not use the id to lookup
values.  (BUG: 1019690) (reported and debugging help from Matt
Kucenski)

8/30/04: Update: modified fs_data_lookup_noid to return unamed data
attribute if that type is requested (instead of just relying on id
value in attributes)

8/31/04: Update: Updated file to v4.10, which seems to fix the
CYGWIN compile problem.

9/1/04: Update: Added more DOS partition types to mmls (submitted by
Matt Kucenski)

9/2/04: Update: Added EXT3FS extended attributes and Posix ACL to istat
output.

9/2/04: Update: Added free inode and block counts per group to fsstat for
EXT2FS.

9/7/04: Bug Fix: FreeBSD compile error for PRIx printf stuff in mmtools/gpt.c


---------------- VERSION 1.71 --------------
06/05/04: Update: Added sanity checks in fat to unix time conversion so that
invalid times are set to 0.

06/08/04: Bug Fix: Added a type cast when size is assigned in FAT 
and removed the assignment to a 32-bit signed variable (which was no
longer needed).  (Bug: 966839)

06/09/04: Bug Fix: Added a type cast to the 'getuX' macros because some
compilers were assuming it was signed (Bug: 966839).  

06/11/04: Update: Changed NTFS magic check to use the aa55 at the
end and fixed the name of the original "magic" value to oemname.
The oemname is now printed in fsstat.

06/12/04: Bug Fix: The NTFS serial number was being printed with
bytes in the wrong order in the fsstat output. (BUG: 972207)

06/12/04: Update: The begin offset value in index header for NTFS 
was 16-bits instead of 32-bits.

06/22/04: Update: Created a library for the MD5 and SHA1 functions so
that it can be incorporated into other tools.  Also renamed some of the
indexing tools that hfind uses.

06/23/04: Update: Changed output of 'istat' for NTFS images.  Added more
data from $STANDARD_INFORMATION.  

07/13/04: Update: Changed output of 'istat' for NTFS images again.  Moved
more data to the $FILE_NAME section and added new data.

07/13/04: Update: Changed code for processing NTFS runs and no
longer check for the offset to be 0 in ntfs_make_data_run().  This
could have prevented some sparse files from being processed.

07/13/04: Update: Added flags for compressed and encrypted NTFS
files.  They are not decrypted or uncompressed yet, just identified.
They cannot be displayed from 'icat', but the known layout is given
in 'istat'.

07/18/04: Bug Fix: Sometimes, 'icat' would report an error about an
existing FILLER entry in an NTFS attribute.  This was traced to
instances when it was run on a non-base file record.  There is now
a check for that to not show the error. (BUG: 993459)

07/19/04: Bug Fix: A run of -1 may exist for sparse files in non-NT
versions of NTFS.  Changed check for this.  reported by Matthew
Kucenski.  (BUG: 994024).

07/24/04: Bug Fix: NTFS attribute names were missing (rarely) on
some files because the code assumed they would always be at offset
64 for non-res attributes (Bug: 996981).

07/24/04: Update: Made listing of unallcoated NTFS file names less
strict.  There was a check for file name length versus stream length.

07/24/04: Update: Added $OBJECT_ID output to 'istat'

07/24/04: Update: Fixed ntfs.c compile warning about constant too
large in time conversion code.

07/25/04: Update: Added attribute list contents to NTFS 'istat' output

07/25/04: Bug Fix: Not all slack space was being shown with 'dls -s'.
It was documented that this occurs, but it is not what would be
expected.  (BUG: 997800).

07/25/04: Update: Changed output format of 'dls -s' so that it sends
zeros where the file content was.  Therefore the output is now a
multiple of the data unit size.  Also removed limitation to FAT &
NTFS.

07/25/04: Update: 'dcalc' now has the '-s' option calculate the 
original location of data from a slack space image (dls -s).  
(from Chris Betz).  

07/26/04: Update: Created the fs_os.h file and adjusted some of the 
header files for the PRI macros (C99).  Created defines for OSes that do
not have the macros already defined.  

07/26/04: Non-release bug fix: Fixed file record size bug introduced with
recent changes.

07/27/04: Update: Added GPT support to mmls.

07/29/04: Update: Added '-p' flag to 'ifind' to find deleted NTFS files 
that point to the given parent directory.  Added '-l and -z' as well.


---------------- VERSION 1.70 --------------
04/21/04: Update: Changed attribute and mode for FAT 'istat' so
that actual FAT attributes are used instead of UNIX translation.

04/21/04: Update: The FAT 'istat' output better handles Long FIle
Name entry

04/21/04: Update: The FAT 'istat' output better handles Volume Label
entry

04/21/04: Update: Allowed the FAT volume label entry to be displayed
with 'ils'

04/21/04: Update: Allowed the FAT volume label entry to be displayed
with 'fls'

04/24/04: Update: 'dstat' on a FAT cluster now shows the cluster
address in addition to the sector address.

04/24/04: Update: Added the cluster range to the FAT 'fsstat' output

05/01/04: Update: Improved the FAT version autodetect code.  

05/02/04: Update: Removed 'H' flag from 'icat'.

05/02/04: Update: Changed all of the FS_FLAG_XXX variables in the
  file system tools to constants that are specific to the usage
  (NAME, DATA, META, FILE).  

05/03/04: Update: fatfs_inode_walk now goes by sectors instead of clusters
  to get more dentries from slack space.

05/03/04: Bug Fix: The allocation status of FAT dentires was set only by
  the flag and not the allocation status of the cluster it is located in.
  (BUG: 947112)

05/03/04: Update: Improved comments and variable names in FAT code

05/03/04: Update: Added '-r' flag to 'icat' for deleted file recovery

05/03/04: Update: Added RECOVERY flag to file_walk for deleted file
  recovery

05/03/04: Update: Added FAT file recovery.  

05/03/04: Update: Removed '-H' flag from 'icat'.  Default is to 
  display holes.
  
05/03/04: Update: 'fls -r' will recurse down deleted directories in FAT

05/03/04: Update: 'fsstat' reports FAT clusters that are marked as BAD

05/03/04: Update: 'istat' for FAT now shows recovery clusters for 
  deleted files.

05/04/04: Update:  Added output to 'fsstat' for FAT file systems by adding
  a list of BAD sectors and improving the amount of layout information.  I
  also changed some of the internal variables. 

05/08/04: Update: Removed addr_bsize from FS_INFO, moved block_frags 
  to FFS_INFO, modified dcat output only data unit size.

05/20/04: Update: Added RECOVERY flag to 'ifind' so that it can find the
  data units that are allocated to deleted files

05/20/04: Update: Added icat recovery options to 'sorter'.

05/20/04: Update: Improved the naming convention in sorter for the 'ils' 
  dead files.

05/21/04: Update: Added outlook to sorter rules (from David Berger)

05/27/04: Bug Fix: Added <linux/unistd.h> to mylseek.c so that it compiles
with Fedora Core 2 (Patch by Angus Marshall) (BUG: 961908).

05/27/04: Update: Changed the letter with 'fls -l' for FIFO to 'p' 
instead of 'f' (reported by Dave Henkewick).

05/28/04: Update: Added '-u' flag to 'dcat' so that the data unit size
can be specified for raw, swap, and dls image types.

05/28/04: Update: Changed the size  argument  of 'dcat' to be number of
data units instead of size in bytes (suggestion by Harald Katzer).


---------------- VERSION 1.69 --------------
03/06/04: Update: Fixed some memory leaks in ext2fs_close.  reported
  by Paul Bakker.
03/10/04: Bug Fix: If the '-s' flag was used with 'icat' on a EXT2FS
  or FFS file system, then a large amount of extra data came out.
  Reported by epsion.  (BUG: 913874)
03/10/04: Bug Fix: One of the verbose outputs in ext2fs.c was being sent
  to STDOUT instead of logfp. (BUG: 913875)
04/14/04: Update: Added more data to fsstat output of FAT file system.
04/15/04: Bug Fix:  The last sector of a FAT file system may not
  be analyzed.  (BUG: 935976)
04/16/04: Update: Added full support for swap and raw by making the
 standard files and functions for them instead of the hack in dcat.
 Suggested by (and initial patch by) Paul Baker.
04/18/04: Update: Changed error messages in EXT2/3FS  code to be extXfs.
04/18/04: Update: Updaged to version 4.09 of 'file'.  This will
  help fix some of the problems people have had compiling it under
  OS X 10.3.
04/18/04: Update: Added compiling support for SFU 3.5 (Microsoft).  Patches
  from an anonymous person.


---------------- VERSION 1.68 --------------
01/20/04: Bug Fix: FAT times were an hour too fast during daylight savings.
  Now use mktime() instead of manual calculation.  Reported by Randall 
  Shane. (BUG: 880606)
02/01/04: Update: 'hfind -i' now reports the header entry as an invalid
  entry.  The first header row was ignored.
02/20/04: Bug Fix: indirect block pointer blocks would not be identified by
 the ifind tool.  Reported by Knut Eckstein (BUG: 902709)
03/01/04: Update: Added fs->seek_pos check to fs_read_random.

---------------- VERSION 1.67 --------------
11/15/03: Bug Fix: Added support for OS X 10.3 to src/makedefs. (BUG: 843029)
11/16/03: Bug Fix: Mac partition tables could generate an error if there were
  VOID-type partitions.   (BUG: 843366)
11/21/03: Update: Changed NOABORT messages to verbose messages, so invalid
  data is not printed during 'ifind' searches.
11/30/03: Bug Fix: icat would not hide the 'holes' if '-h' was given because
  the _UNALLOC flag was always being passed to file_walk.  (reported by
  Knut Eckstein).  (BUG: 851873)
11/30/03: Bug Fix: NTFS data_walk was not using _ALLOC and _UNALLOC flags 
  and other code that called it was not either.  (BUG: 851895)
11/30/03: Bug Fix:  Not all needed commands were using _UNALLOC when they
  called file_walk (although for most cases it did not matter because
  sparse files would not be found in a directory for example). (Bug: 851897)  
12/09/03: Bug Fix: FFS and EXT2FS code was using OFF_T type instead of
  size_t for the size of the file. This could result in a file > 2GB
  as being a negative size on some systems (BUG: 856957). 
12/26/03: Bug Fix: ffind would crash for root directory of FAT image.
  Added NULL check and added a NULL name to fake root directory entry.
  (BUG: 871219)
01/05/04: Bug Fix: The clustcnt value for FAT was incorrectly calculated
  and was too large for FAT12 and FAT16 by 32 sectors.  This could produce
  extra entries in the 'fsstat' output when the FAT is dumped.  
  (BUG: 871220)
01/05/04: Bug Fix: ils, fls, and istat were not printing the full size
  of files that are > 2GB.  (reported by Knut Eckstein) (BUG: 871457) 
01/05/04: Bug Fix: The EXT2FS and EXT3FS code was not using the
  i_dir_acl value as the upper 32-bits of regular files that are
  > 2GB (BUG:  871458)
01/06/04: Mitigation: An error was reported where sorter would error
  that icat was being passed a '-1' argument.  I can't find how that would
  happen, so I added quotes to all arguments so that the next time it 
  occurs, the error is more useful (BUG: 845840).
01/06/04: Update: Incorporated patch from Charles Seeger so that 'cc'
  can be used and compile time warnings are fixed with Sun 'cc'.  
01/06/04: Update: Upgraded file from v3.41 to v4.07


To generate a diff of this commit:
cvs -z3 rdiff -u -r0 -r1.1 wip/sleuthkit/patches/patch-ac \
    wip/sleuthkit/patches/patch-ad wip/sleuthkit/patches/patch-ae

To view a diff of this commit:
http://pkgsrc-wip.cvs.sourceforge.net/pkgsrc-wip/wip/sleuthkit/patches/patch-ac?r1=0&r2=1.1
http://pkgsrc-wip.cvs.sourceforge.net/pkgsrc-wip/wip/sleuthkit/patches/patch-ad?r1=0&r2=1.1
http://pkgsrc-wip.cvs.sourceforge.net/pkgsrc-wip/wip/sleuthkit/patches/patch-ae?r1=0&r2=1.1

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
pkgsrc-wip-cvs mailing list
pkgsrc-wip-cvs%lists.sourceforge.net@localhost
https://lists.sourceforge.net/lists/listinfo/pkgsrc-wip-cvs