changes.txt

linux下开发的针对所有磁盘的数据恢复的源码

10/28/04: Update: Removed usage of mylseek in fstools for all systems
  (Bug: 928278)


---------------- VERSION 1.72 --------------
07/31/04: Update: Added flag to mft_lookup so that ifind can run in noabort
mode and it will not stop when it finds an invalid magic value.

08/01/04: Update: Removed previous change and removed MAGIC check
entirely.  XP doesn't even care if the Magic is corrupt, so neither
does TSK.  The update sequence check should find an invalid MFT
entry.

08/01/04: Update: Added error message to 'ifind' if none of the search
options are given.

08/05/04: Bug Fix: Fixed g_curdirptr recursive error by clearing the value
when dent_walk had to abort because a deleted directory could not be recovered.
(BUG:  1004329)  Reported by [e-mail]

08/16/04: Update: Added a sanity check to fatfs.c fat2unixtime to check
if the year is > 137 (which is the overflow date for the 32-bit UNIX time).

08/16/04: Update: Added first version of sstrings from binutils-2.15

08/20/04: Bug Fix: Fixed a bug where the group number for block 0 of an 
EXT2FS file system would report -1. 'dstat' no longer displays value when it
is not part of a block group. (BUG: 1013227)

8/24/04: Update: If an attribute list entry is found with an invalid MFT
entry address, then it is ignored instead of an error being generated and
exiting.

8/26/04: Update: Changed internal design of NTFS to make is_clust_alloc

8/26/04: Update: If an attribute list entry is found with an invalid MFT
entry address AND the entry is unallocated, then no error message is 
printed, it is just ignored or logged in verbose mode.

8/29/04: Update: Added support for 32-bit GID and UID in EXTxFS

8/30/04: Bug Fix: ntfs_dent_walk was adding 24 extra bytes to the
size of the index record for the final record processing (calc of
list_len) (BUG: 1019321) (reported and debugging help from Matt
Kucenski).

8/30/04: Bug Fix: fs_data_lookup was using an id of 0 as a wild
card, but 0 is a legit id value and this could cause confusion.  To
solve this, a new FS_FLAG_FILE_NOID flag was added and a new
fs_data_lookup_noid function that will not use the id to lookup
values.  (BUG: 1019690) (reported and debugging help from Matt
Kucenski)

8/30/04: Update: modified fs_data_lookup_noid to return unamed data
attribute if that type is requested (instead of just relying on id
value in attributes)

8/31/04: Update: Updated file to v4.10, which seems to fix the
CYGWIN compile problem.

9/1/04: Update: Added more DOS partition types to mmls (submitted by
Matt Kucenski)

9/2/04: Update: Added EXT3FS extended attributes and Posix ACL to istat
output.

9/2/04: Update: Added free inode and block counts per group to fsstat for
EXT2FS.

9/7/04: Bug Fix: FreeBSD compile error for PRIx printf stuff in mmtools/gpt.c


---------------- VERSION 1.71 --------------
06/05/04: Update: Added sanity checks in fat to unix time conversion so that
invalid times are set to 0.

06/08/04: Bug Fix: Added a type cast when size is assigned in FAT 
and removed the assignment to a 32-bit signed variable (which was no
longer needed).  (Bug: 966839)

06/09/04: Bug Fix: Added a type cast to the 'getuX' macros because some
compilers were assuming it was signed (Bug: 966839).  

06/11/04: Update: Changed NTFS magic check to use the aa55 at the
end and fixed the name of the original "magic" value to oemname.
The oemname is now printed in fsstat.

06/12/04: Bug Fix: The NTFS serial number was being printed with
bytes in the wrong order in the fsstat output. (BUG: 972207)

06/12/04: Update: The begin offset value in index header for NTFS 
was 16-bits instead of 32-bits.

06/22/04: Update: Created a library for the MD5 and SHA1 functions so
that it can be incorporated into other tools.  Also renamed some of the
indexing tools that hfind uses.

06/23/04: Update: Changed output of 'istat' for NTFS images.  Added more
data from $STANDARD_INFORMATION.  

07/13/04: Update: Changed output of 'istat' for NTFS images again.  Moved
more data to the $FILE_NAME section and added new data.

07/13/04: Update: Changed code for processing NTFS runs and no
longer check for the offset to be 0 in ntfs_make_data_run().  This
could have prevented some sparse files from being processed.

07/13/04: Update: Added flags for compressed and encrypted NTFS
files.  They are not decrypted or uncompressed yet, just identified.
They cannot be displayed from 'icat', but the known layout is given
in 'istat'.

07/18/04: Bug Fix: Sometimes, 'icat' would report an error about an
existing FILLER entry in an NTFS attribute.  This was traced to
instances when it was run on a non-base file record.  There is now
a check for that to not show the error. (BUG: 993459)

07/19/04: Bug Fix: A run of -1 may exist for sparse files in non-NT
versions of NTFS.  Changed check for this.  reported by Matthew
Kucenski.  (BUG: 994024).

07/24/04: Bug Fix: NTFS attribute names were missing (rarely) on
some files because the code assumed they would always be at offset
64 for non-res attributes (Bug: 996981).

07/24/04: Update: Made listing of unallcoated NTFS file names less
strict.  There was a check for file name length versus stream length.

07/24/04: Update: Added $OBJECT_ID output to 'istat'

07/24/04: Update: Fixed ntfs.c compile warning about constant too
large in time conversion code.

07/25/04: Update: Added attribute list contents to NTFS 'istat' output

07/25/04: Bug Fix: Not all slack space was being shown with 'dls -s'.
It was documented that this occurs, but it is not what would be
expected.  (BUG: 997800).

07/25/04: Update: Changed output format of 'dls -s' so that it sends
zeros where the file content was.  Therefore the output is now a
multiple of the data unit size.  Also removed limitation to FAT &
NTFS.

07/25/04: Update: 'dcalc' now has the '-s' option calculate the 
original location of data from a slack space image (dls -s).  
(from Chris Betz).  

07/26/04: Update: Created the fs_os.h file and adjusted some of the 
header files for the PRI macros (C99).  Created defines for OSes that do
not have the macros already defined.  

07/26/04: Non-release bug fix: Fixed file record size bug introduced with
recent changes.

07/27/04: Update: Added GPT support to mmls.

07/29/04: Update: Added '-p' flag to 'ifind' to find deleted NTFS files 
that point to the given parent directory.  Added '-l and -z' as well.


---------------- VERSION 1.70 --------------
04/21/04: Update: Changed attribute and mode for FAT 'istat' so
that actual FAT attributes are used instead of UNIX translation.

04/21/04: Update: The FAT 'istat' output better handles Long FIle
Name entry

04/21/04: Update: The FAT 'istat' output better handles Volume Label
entry

04/21/04: Update: Allowed the FAT volume label entry to be displayed
with 'ils'

04/21/04: Update: Allowed the FAT volume label entry to be displayed
with 'fls'

04/24/04: Update: 'dstat' on a FAT cluster now shows the cluster
address in addition to the sector address.

04/24/04: Update: Added the cluster range to the FAT 'fsstat' output

05/01/04: Update: Improved the FAT version autodetect code.  

05/02/04: Update: Removed 'H' flag from 'icat'.

05/02/04: Update: Changed all of the FS_FLAG_XXX variables in the
  file system tools to constants that are specific to the usage
  (NAME, DATA, META, FILE).  

05/03/04: Update: fatfs_inode_walk now goes by sectors instead of clusters
  to get more dentries from slack space.

05/03/04: Bug Fix: The allocation status of FAT dentires was set only by
  the flag and not the allocation status of the cluster it is located in.
  (BUG: 947112)

05/03/04: Update: Improved comments and variable names in FAT code

05/03/04: Update: Added '-r' flag to 'icat' for deleted file recovery

05/03/04: Update: Added RECOVERY flag to file_walk for deleted file
  recovery

05/03/04: Update: Added FAT file recovery.  

05/03/04: Update: Removed '-H' flag from 'icat'.  Default is to 
  display holes.
  
05/03/04: Update: 'fls -r' will recurse down deleted directories in FAT

05/03/04: Update: 'fsstat' reports FAT clusters that are marked as BAD

05/03/04: Update: 'istat' for FAT now shows recovery clusters for 
  deleted files.

05/04/04: Update:  Added output to 'fsstat' for FAT file systems by adding
  a list of BAD sectors and improving the amount of layout information.  I
  also changed some of the internal variables. 

05/08/04: Update: Removed addr_bsize from FS_INFO, moved block_frags 
  to FFS_INFO, modified dcat output only data unit size.

05/20/04: Update: Added RECOVERY flag to 'ifind' so that it can find the
  data units that are allocated to deleted files

05/20/04: Update: Added icat recovery options to 'sorter'.

05/20/04: Update: Improved the naming convention in sorter for the 'ils' 
  dead files.

05/21/04: Update: Added outlook to sorter rules (from David Berger)

05/27/04: Bug Fix: Added <linux/unistd.h> to mylseek.c so that it compiles
with Fedora Core 2 (Patch by Angus Marshall) (BUG: 961908).

05/27/04: Update: Changed the letter with 'fls -l' for FIFO to 'p' 
instead of 'f' (reported by Dave Henkewick).

05/28/04: Update: Added '-u' flag to 'dcat' so that the data unit size
can be specified for raw, swap, and dls image types.

05/28/04: Update: Changed the size  argument  of 'dcat' to be number of
data units instead of size in bytes (suggestion by Harald Katzer).


---------------- VERSION 1.69 --------------
03/06/04: Update: Fixed some memory leaks in ext2fs_close.  reported
  by Paul Bakker.
03/10/04: Bug Fix: If the '-s' flag was used with 'icat' on a EXT2FS
  or FFS file system, then a large amount of extra data came out.
  Reported by epsion.  (BUG: 913874)
03/10/04: Bug Fix: One of the verbose outputs in ext2fs.c was being sent
  to STDOUT instead of logfp. (BUG: 913875)
04/14/04: Update: Added more data to fsstat output of FAT file system.
04/15/04: Bug Fix:  The last sector of a FAT file system may not
  be analyzed.  (BUG: 935976)
04/16/04: Update: Added full support for swap and raw by making the
 standard files and functions for them instead of the hack in dcat.
 Suggested by (and initial patch by) Paul Baker.
04/18/04: Update: Changed error messages in EXT2/3FS  code to be extXfs.
04/18/04: Update: Updaged to version 4.09 of 'file'.  This will
  help fix some of the problems people have had compiling it under
  OS X 10.3.
04/18/04: Update: Added compiling support for SFU 3.5 (Microsoft).  Patches
  from an anonymous person.


---------------- VERSION 1.68 --------------
01/20/04: Bug Fix: FAT times were an hour too fast during daylight savings.
  Now use mktime() instead of manual calculation.  Reported by Randall 
  Shane. (BUG: 880606)
02/01/04: Update: 'hfind -i' now reports the header entry as an invalid
  entry.  The first header row was ignored.
02/20/04: Bug Fix: indirect block pointer blocks would not be identified by
 the ifind tool.  Reported by Knut Eckstein (BUG: 902709)
03/01/04: Update: Added fs->seek_pos check to fs_read_random.

---------------- VERSION 1.67 --------------
11/15/03: Bug Fix: Added support for OS X 10.3 to src/makedefs. (BUG: 843029)
11/16/03: Bug Fix: Mac partition tables could generate an error if there were
  VOID-type partitions.   (BUG: 843366)
11/21/03: Update: Changed NOABORT messages to verbose messages, so invalid
  data is not printed during 'ifind' searches.
11/30/03: Bug Fix: icat would not hide the 'holes' if '-h' was given because
  the _UNALLOC flag was always being passed to file_walk.  (reported by
  Knut Eckstein).  (BUG: 851873)
11/30/03: Bug Fix: NTFS data_walk was not using _ALLOC and _UNALLOC flags 
  and other code that called it was not either.  (BUG: 851895)
11/30/03: Bug Fix:  Not all needed commands were using _UNALLOC when they
  called file_walk (although for most cases it did not matter because
  sparse files would not be found in a directory for example). (Bug: 851897)  
12/09/03: Bug Fix: FFS and EXT2FS code was using OFF_T type instead of
  size_t for the size of the file. This could result in a file > 2GB
  as being a negative size on some systems (BUG: 856957). 
12/26/03: Bug Fix: ffind would crash for root directory of FAT image.
  Added NULL check and added a NULL name to fake root directory entry.
  (BUG: 871219)
01/05/04: Bug Fix: The clustcnt value for FAT was incorrectly calculated
  and was too large for FAT12 and FAT16 by 32 sectors.  This could produce
  extra entries in the 'fsstat' output when the FAT is dumped.  
  (BUG: 871220)
01/05/04: Bug Fix: ils, fls, and istat were not printing the full size
  of files that are > 2GB.  (reported by Knut Eckstein) (BUG: 871457) 
01/05/04: Bug Fix: The EXT2FS and EXT3FS code was not using the
  i_dir_acl value as the upper 32-bits of regular files that are