Simson L. Garfinkel
Simson L. Garfinkel
@arisjr - I want to confirm that the MD5 of your disk image is 8a7b3262064f8d75b37ccb96103c2896
and I should run tsk_loaddb with both of these?
> An APFS image I just did to test on apfs also. > > https://drive.google.com/file/d/1_usLsiB_ReyRN64G9ZQ9KYk0nv_nrPBi/view?usp=drive_link It would be great if you could code these as E01 rather than 7zip, but...
Well, I've added your images to the CI/CD process, so hopefully that will soon be crashing. I'm also adding support for AFF to the CI/CD system, so hopefully those bugs...
> Well, I've added your images to the CI/CD process, so hopefully that will soon be crashing. > I'm also adding support for AFF to the CI/CD system, so hopefully...
> Is there a working afflib??? Yes, it's being maintained by @sshock. See https://github.com/sleuthkit/sleuthkit/issues/992
> > I was under the impression that the APFS implementation and its treatment of pools was broken in a "that can't possibly work" way after it was adapted from...
I'm confused about the relationship between `IMG_INFO *` and `TSK_IMG_INFO *`, especially in `APFSPool::clear_cache()`. How are these related?
> > Perhaps tsk_img_close could check if the img_info is already closed and just "return" if it is. > > It was accidental that calling `tsk_img_close` more than once on...
> `TskAutoDb::addUnallocFsSpaceToDb()` is quite broken. I've already found two unrelated things when debugging this which cannot possibly work correctly, viz.: > > ``` > const auto pool = tsk_pool_open_img_sing(m_img_info, curVsDbInfo.offset,...