sleuthkit icon indicating copy to clipboard operation
sleuthkit copied to clipboard

Inconsistent device block size assigned in hfs.c

Open InvisiblePhil opened this issue 4 years ago • 3 comments

hfs.c assigns device block size (dev_bsize) as follows:

    /* this isn't really accurate; fs->block_size reports only the size
       of the allocation block; the size of the device block has to be
       found from the device (allocation block size should always be
       larger than device block size and an even multiple of the device
       block size) */
    fs->dev_bsize = fs->block_size =
        tsk_getu32(fs->endian, hfs->fs->blk_sz);

All other filesystems use the value already stored in TSK_IMG_INFO::sector_size

InvisiblePhil avatar Jun 03 '21 09:06 InvisiblePhil

@InvisiblePhil I'm trying to find code that actually uses dev_bsize. Did you see an issue with this being teh wrong value? I'm wondering why that value exists any more...

bcarrier avatar Jul 31 '21 14:07 bcarrier

@bcarrier We use the SleuthKit as a library within our own applications, and have been using this value ourselves to indicate the device block size. I understand the command-line tools do not seem to use this value, and so if that's the case then I can see the point to remove it.

So if this variable is not intended to be used, then we will have to update our own code to find the value from the correct location and this issue could be closed?

InvisiblePhil avatar Aug 11 '21 13:08 InvisiblePhil

@bcarrier We've stopped using this variable in all of our code based on your comment, so I suppose the question shifts to whether you would prefer this variable to be deprecated/removed vs having it at least be a 'consistent' value for as long as it is kept.

InvisiblePhil avatar Nov 19 '21 11:11 InvisiblePhil