todo.txt

linux下开发的针对所有磁盘的数据恢复的源码

Brian's TSK TODO List
========================================================================

3.1
Python?
std wchar_t API to tsk_img_open and ifind

Make sigfind use imagelayer

HFS:
- Make tree searching use node-based reads
-- Allow read() API to be used to read catalog and extents
--- Create ATTRLIST from extents file
--- Create ATTRLIST for Catalog
-- Update hfs_dent so that it reads nodes at a time
- fix bug with test image name
- add ifind changes
- go through @@@ statements

-- Other --
Make NTFS function to process MFT entry buffer (for memory parsing)

Bug Fixes:
- Verify VDL slack / init_size fix (need test image)

ATTRIBUTE Functions:
- should make FFS/ExtX indirect blocks be in special attribute

- Windows version does not do globbing of cmd line arguments

Minor Feature Change:
- Make ffind code more library friendly and formalize a function to
map inode to name(s)
- Document handling of deleted files. What happens when file can't be recovered...
- Add afflib crypto support
- Could have better fsstat output that identifies which final sectors
are missing in image.
- make ifind more library friendly by not printing all results
- Change istat and fsstat to print to strings instead of FILE
- make '-S' option for icat that outputs only slack space (Wyatt)


Automated Tests:
- Add raw / swapfs tests
- Add FFS sparse files to test set
- Make img_stat regression tests for aff / ewf files


Incorporate JFS code in.

There are more offsets in NTFS attributes that we should be validating to 
make sure that they are in teh allocated buffer...


Make return codes when opening a FS differentiate between not being a file
system and being a corrupt file system (for a more accurate error message)

=========================================================================
                         GENERAL
=========================================================================


=========================================================================
                      DISK TOOLS
=========================================================================
- diskstat: Use 48-bit commands -- support USB / Firewire devices
- Add DCO detection


=========================================================================
                         FILE SYSTEM
=========================================================================
GENERAL:
- SQL Patch
- fsstat
  - stats on number of things free
  - UNIX bitmaps per group 
  - List bad blocks (done for FAT)
- New line of 'f' tools that utilize 'ifind' code:
  - fstat (istat from path)
  - fcat
- Need jfind code to find entries based on FS block number
- Use backup copy of boot sector if primary fails (done for FAT).
- output data of ils
- Incorporate the FS_FLAG_DATA_BAD flag into operation
- Incorporate HFS


---------------------------------------------------------------
FAT: 
- come up with better solution for determing size of deleted FAT 
directories.  Currently assuming 0 or cluster size.
- Running ffind on a lfn FAT directory entry results in an "ORPHAN"
entry because the LFN entries are not sent via inode_walk...  perhaps
make a new flag or a special FAT function. (BUG: 1326007)
- could add a check to alert a file that has VOL_NAME set in non-root dir
- Maybe fatfs_dent_walk should only check the times for the first
entry and not be so strict.  0's can be used if the time is invalid.


---------------------------------------------------------------
FFS:
- HP Support
- Display disk labels in fsstat

---------------------------------------------------------------
EXTxFS:

---------------------------------------------------------------
NTFS: 
- Make (realloc) appear on NTFS because of sequence numbers being off....
- figure out a better way that $BADCLUS does not screw things up
if it has a value in the first run.
- deleted ADS
- Read the Security Attributes
- BAAD 
- when doing a timeline in NTFS: do three time machine entries:
  - time in parent directory
  - time in STD_INFO
  - time in $FNAME

---------------------------------------------------------------
UFS:


---------------------------------------------------------------
ISO9660:
Support more ISO9660 Rock Ridge entry types
Print extended attributes
ISO files with multiple entries...
ISO Volume set

----------------------------------------------------------
HFS:
hfs_open has a bunch of functions that  do not check return value
HFS: still need to update error reporting.  
-- errors when doing ils -e:
Error finding catalog entry 22 in catalog22|f|0|0|2212122496|2212122496|2212122496|0|0|0|0|0

=========================================================================
                         HASH TOOLS
=========================================================================
- hls
- extended output for NSRL 


=========================================================================
                         IMAGE LAYER
=========================================================================

- need an img_integ tool that will verify the ingetrigy of an image
 (will require the hash to be passed for raw and split files)


=========================================================================
                      MEDIA MANAGEMENT
=========================================================================
- Add status flags to mac mmls
- Add bootable flag to mm code for DOS
- mmls in recursive does not always print location relative to start
of disk i.e. intel solaris disk offsets are relative to start of
solaris partition and not disk - should this be modified?
- add sanity checks based on image size to determine if values are valid
- mmstat could have an option where when given a partition number, it
gives stats about that volume (layout, type (META etc.))

=========================================================================
                         SEARCHING
=========================================================================
- indexing
- sstrings and Locale:
  http://lidn.sourceforge.net/articles/unicode_programming/l-linuni.html
- Incorporate grep or basic regexp to search files


=========================================================================
                         SORTER
=========================================================================
- minimum size for files
- add extension to files that do not have one based on their file type.


=========================================================================
                         TIMELINES
=========================================================================
- scripts to incorporate logs and such into mactime
- make 'mactime' able to run with '-w'
- comma delimited version should have seperate column for deleted status
(suggested by Keith Wood)