robjoyce/sleuthkit — pull request #4 by MattStillerman (2012-07-25 19:52:31+00:00)
Title: Handles HFS+ optional special files.

... special files, with improved logic to avoid errors, and improved verbose messages.

Summary of changes:

hfs_open: Now tests for the presence of three optional special files, and records the results in the HFS_INFO struct. These files are, the Extents File (and BadBlocks File), the Startup File, and the Attributes File. When determining the creation times of the key system directories, this function now will issue a warning only if the root directory is not accessible. The other two "metadata" directories should be considered optional because older file systems might not have them.

hfs_ext_find_extent_record_attr: This function now returns immediately without error if the Extents file is not present.

hfs_follow_hard_link: If flags indicate that the given catalog entry is a hard linked file or directory, and if none of the three key system directories are accessible, then this function will return an error (as before). However, if some of these directories are accessible, but not all, then a warning will be issued, as follows:

In case of a hard linked file -- if either the root directory or the /^^^^HFS+ Private Data directory are not accessible, then a warning is issued, but the function still tries to test and resolve the hard link.

In case of a hard linked directory (or folder): if any of the three key directories are not accessible, then a warning is issued, but the function still tries to test and resolve the hard link.

In either of these two cases, it is unlikely but possible that the test for a hard link could give a false negative. In either of these two cases, further errors or warnings are possible, as processing continues.

hfs_inode_lookup: When looking up the inum (or CNID) of one of the special files, if it is one of the optional ones, then, if it is not present, that is now an error. N.B., hfs_inode_lookup is supposed to return an error if it cannot find the given inum.

hfs_load_extended_attrs: Will now return immediately without error if the Attributes file is not present.

Plus, some other very minor code adjustments.