pytsk/libtsk does not correctly/fully handle ext2, ext3, ext4 #60
Description
libtsk (and therefore pytsk) does not correctly handle ext2, ext3, ext4. Issues reported to upstream:
fls with ext4: multiple errors on inode with inline data sleuthkit/sleuthkit#1979 incorrect handling of inline dataicat with ext4: error on inode with inline data sleuthkit/sleuthkit#1980 incorrect handling of inline dataext4: icat/istat discrepancy between operating system and TSK sleuthkit/sleuthkit#2002 incorrect handling of implicit sparse extentext4: istat/icat do not properly handle uninitialized extent sleuthkit/sleuthkit#2009 incorrect handling of uninitialized extentsleuthkit 4.10.1 was released - changes to attempt upgrade of pytsk Updated to Sleuthkit 4.10.1 #71 #69 - still issues with mix of C and C++ used by libtsk- istat not showing extended attributes stored in inode for ext[2-4] sleuthkit/sleuthkit#2487 incorrect handling of extended attributes and extra/extended inode size
- istat add ext4 large extended attributes (ea_inode) support sleuthkit/sleuthkit#2488 no support for large extended attributes (ea_inode)
- multiple observations of the pytsk/libtsk attribute interface #79 unable to retrieve extended attributes with tsk_fs_attrlist_get_idx
- Ext4: add support for meta_bg feature sleuthkit/sleuthkit#2855 possibly incorrectly handling meta_bg feature
- ext4: native Linux considers out-of-order extents an error case sleuthkit/sleuthkit#3140 handling of out-of-order extents different from native Linux implementation without indication
- ext2: add support for non-utf8 filename encoding / add means to set codepage sleuthkit/sleuthkit#3141 handling of non-UTF8 filenames
- fsstat unable to determine file system type of ext3 or ext4 image with journal_dev sleuthkit/sleuthkit#3387 unable to open ext3 and ext4 file systems with journal_dev
- ext2 with inode size > 128: Missing extra precision in istat output sleuthkit/sleuthkit#3388 ext2 with inode size > 128: Missing extra precision and creation time