[Forensics-changes] [SCM] debian-forensics/sleuthkit branch, debian, updated. debian/3.0.1-5-12-g7fcbe48
Cristian Greco
cristian at regolo.cc
Wed Feb 17 03:48:57 UTC 2010
The following commit has been merged in the debian branch:
commit ecca8fac65b46128c5906667ccd216f9b6dd6d52
Author: Cristian Greco <cristian at regolo.cc>
Date: Sat Feb 13 03:02:47 2010 +0100
debian/patches: refresh 01-fix-hfind-manpage.patch,
02-fix-hyphens-manpages.patch; drop 10_fix_compiler_warnings.patch, fixed
upstream.
diff --git a/debian/patches/01-fix-hfind-manpage.patch b/debian/patches/01-fix-hfind-manpage.patch
index 550f33f..e4d09a2 100644
--- a/debian/patches/01-fix-hfind-manpage.patch
+++ b/debian/patches/01-fix-hfind-manpage.patch
@@ -1,10 +1,9 @@
Author: Martin A. Godisch <godisch at debian.org>
Description: Adjust a verbose description in hfind(1) (see #411026).
-diff -Naurp sleuthkit.orig/man/hfind.1 sleuthkit/man/hfind.1
---- sleuthkit.orig/man/hfind.1 2009-07-29 16:35:37.000000000 +0000
-+++ sleuthkit/man/hfind.1 2009-07-29 17:20:00.000000000 +0000
-@@ -131,8 +131,9 @@ or
+--- a/man/hfind.1
++++ b/man/hfind.1
+@@ -131,8 +131,9 @@
<...>
diff --git a/debian/patches/02-fix-hyphens-manpages.patch b/debian/patches/02-fix-hyphens-manpages.patch
index d63cc49..77c19cb 100644
--- a/debian/patches/02-fix-hyphens-manpages.patch
+++ b/debian/patches/02-fix-hyphens-manpages.patch
@@ -1,20 +1,19 @@
Author: Cristian Greco <cristian.debian at gmail.com>
Description: Fixes various lintian warnings about hyphens used as minus sign.
-diff -Naurp sleuthkit.orig/man/blkcalc.1 sleuthkit/man/blkcalc.1
---- sleuthkit.orig/man/blkcalc.1 2009-07-29 16:35:37.000000000 +0000
-+++ sleuthkit/man/blkcalc.1 2009-07-29 17:20:40.000000000 +0000
+--- a/man/blkcalc.1
++++ b/man/blkcalc.1
@@ -3,8 +3,7 @@
blkcalc \- Converts between unallocated disk unit numbers and regular
disk unit numbers.
.SH SYNOPSIS
-.B blkcalc
--[-dsu unit_addr] [-vV] [-i imgtype] [-o imgoffset] [-f fstype] image [images]
-+.B blkcalc [-dsu unit_addr] [-vV] [-i imgtype] [-o imgoffset] [-f fstype] image [images]
+-[-dsu unit_addr] [-vV] [-i imgtype] [-o imgoffset] [-b dev_sector_size] [-f fstype] image [images]
++.B blkcalc [-dsu unit_addr] [-vV] [-i imgtype] [-o imgoffset] [-b dev_sector_size] [-f fstype] image [images]
.SH DESCRIPTION
.B blkcalc
creates a disk unit number mapping between two images, one normal and
-@@ -34,7 +33,7 @@ from
+@@ -34,7 +33,7 @@
.B -s
option is given, then the
.B unit_addr
@@ -23,7 +22,7 @@ diff -Naurp sleuthkit.orig/man/blkcalc.1 sleuthkit/man/blkcalc.1
The
.B image
is the full, original image (i.e. from dd).
-@@ -44,11 +43,11 @@ was called
+@@ -44,11 +43,11 @@
in TSK versions prior to 3.0.0.
.IP "-f fstype"
@@ -37,8 +36,8 @@ diff -Naurp sleuthkit.orig/man/blkcalc.1 sleuthkit/man/blkcalc.1
+Identify the type of image file, such as raw or split. Use '\-i list' to list the supported types.
If not given, autodetection methods are used.
.IP "-o imgoffset"
- The sector offset where the file system starts in the image. Non-512 byte
-@@ -66,7 +65,7 @@ This allows one to identify the original
+ The sector offset where the file system starts in the image.
+@@ -67,7 +66,7 @@
better documentation.
.SH EXAMPLE
@@ -47,10 +46,9 @@ diff -Naurp sleuthkit.orig/man/blkcalc.1 sleuthkit/man/blkcalc.1
.SH "SEE ALSO"
.BR blkls (1),
-diff -Naurp sleuthkit.orig/man/blkcat.1 sleuthkit/man/blkcat.1
---- sleuthkit.orig/man/blkcat.1 2009-07-29 16:35:37.000000000 +0000
-+++ sleuthkit/man/blkcat.1 2009-07-29 17:20:40.000000000 +0000
-@@ -21,23 +21,23 @@ in TSK versions prior to 3.0.0.
+--- a/man/blkcat.1
++++ b/man/blkcat.1
+@@ -21,23 +21,23 @@
.SH ARGUMENTS
.IP -a
Display the contents in ASCII
@@ -78,8 +76,8 @@ diff -Naurp sleuthkit.orig/man/blkcat.1 sleuthkit/man/blkcat.1
+Identify the type of image file, such as raw or split. Use '\-i list' to list the supported types.
If not given, autodetection methods are used.
.IP "-o imgoffset"
- The sector offset where the file system starts in the image. Non-512 byte
-@@ -49,10 +49,10 @@ Display version.
+ The sector offset where the file system starts in the image.
+@@ -50,10 +50,10 @@
.IP -w
Display the contents in an HTML table format.
.IP "image [images]"
@@ -92,10 +90,9 @@ diff -Naurp sleuthkit.orig/man/blkcat.1 sleuthkit/man/blkcat.1
.IP num
Number of data units to display.
-diff -Naurp sleuthkit.orig/man/blkls.1 sleuthkit/man/blkls.1
---- sleuthkit.orig/man/blkls.1 2009-07-29 16:35:37.000000000 +0000
-+++ sleuthkit/man/blkls.1 2009-07-29 17:20:40.000000000 +0000
-@@ -31,16 +31,16 @@ in TCT.
+--- a/man/blkls.1
++++ b/man/blkls.1
+@@ -31,16 +31,16 @@
.IP -e
Copy every block. The output should be similar to dd.
.IP -a
@@ -115,8 +112,8 @@ diff -Naurp sleuthkit.orig/man/blkls.1 sleuthkit/man/blkls.1
+Identify the type of image file, such as raw or split. Use '\-i list' to list the supported types.
If not given, autodetection methods are used.
.IP "-o imgoffset"
- The sector offset where the file system starts in the image. Non-512 byte
-@@ -54,7 +54,7 @@ Turn on verbose mode, output to stderr.
+ The sector offset where the file system starts in the image.
+@@ -55,7 +55,7 @@
.IP -V
Display version.
.IP "image [images]"
@@ -125,10 +122,9 @@ diff -Naurp sleuthkit.orig/man/blkls.1 sleuthkit/man/blkls.1
.IP "start-stop ..."
Examine the specified block number or number range.
.SH LICENSE
-diff -Naurp sleuthkit.orig/man/blkstat.1 sleuthkit/man/blkstat.1
---- sleuthkit.orig/man/blkstat.1 2009-07-29 16:35:37.000000000 +0000
-+++ sleuthkit/man/blkstat.1 2009-07-29 17:20:40.000000000 +0000
-@@ -16,10 +16,10 @@ in TSK versions prior to 3.0.0.
+--- a/man/blkstat.1
++++ b/man/blkstat.1
+@@ -16,10 +16,10 @@
.SH ARGUMENTS
.IP "-f fstype"
@@ -140,8 +136,8 @@ diff -Naurp sleuthkit.orig/man/blkstat.1 sleuthkit/man/blkstat.1
+Identify the type of image file, such as raw or split. Use '\-i list' to list the supported types.
If not given, autodetection methods are used.
.IP "-o imgoffset"
- The sector offset where the file system starts in the image. Non-512 byte
-@@ -29,7 +29,7 @@ Verbose output of debugging statements t
+ The sector offset where the file system starts in the image.
+@@ -30,7 +30,7 @@
.IP -V
Display version
.IP "image [images]"
@@ -150,10 +146,9 @@ diff -Naurp sleuthkit.orig/man/blkstat.1 sleuthkit/man/blkstat.1
.IP addr
Address to display stats on. This is a fragment for UNIX file systems or
a sector for FAT.
-diff -Naurp sleuthkit.orig/man/ffind.1 sleuthkit/man/ffind.1
---- sleuthkit.orig/man/ffind.1 2009-07-29 16:35:37.000000000 +0000
-+++ sleuthkit/man/ffind.1 2009-07-29 17:20:40.000000000 +0000
-@@ -15,7 +15,7 @@ some file systems, this will find delete
+--- a/man/ffind.1
++++ b/man/ffind.1
+@@ -15,7 +15,7 @@
.SH ARGUMENTS
.IP "image [images]"
@@ -162,7 +157,7 @@ diff -Naurp sleuthkit.orig/man/ffind.1 sleuthkit/man/ffind.1
.IP inode
Integer of inode to find.
-@@ -26,12 +26,12 @@ Find all occurrences of inode.
+@@ -26,12 +26,12 @@
Find deleted entries only.
.IP "-f fstype"
Identify the file system type of the image.
@@ -176,8 +171,8 @@ diff -Naurp sleuthkit.orig/man/ffind.1 sleuthkit/man/ffind.1
+Identify the type of image file, such as raw or split. Use '\-i list' to list the supported types.
If not given, autodetection methods are used.
.IP "-o imgoffset"
- The sector offset where the file system starts in the image. Non-512 byte
-@@ -48,7 +48,7 @@ from a disk unit address using
+ The sector offset where the file system starts in the image.
+@@ -49,7 +49,7 @@
.BR ifind(1).
.SH EXAMPLE
@@ -186,10 +181,9 @@ diff -Naurp sleuthkit.orig/man/ffind.1 sleuthkit/man/ffind.1
.SH "SEE ALSO"
.BR ifind (1)
.SH AUTHOR
-diff -Naurp sleuthkit.orig/man/fls.1 sleuthkit/man/fls.1
---- sleuthkit.orig/man/fls.1 2009-07-29 16:35:37.000000000 +0000
-+++ sleuthkit/man/fls.1 2009-07-29 17:20:40.000000000 +0000
-@@ -37,7 +37,7 @@ Display deleted entries only
+--- a/man/fls.1
++++ b/man/fls.1
+@@ -37,7 +37,7 @@
Display directory entries only
.IP "-f fstype"
The type of file system.
@@ -198,7 +192,7 @@ diff -Naurp sleuthkit.orig/man/fls.1 sleuthkit/man/fls.1
If not given, autodetection methods are used.
.IP -F
Display file (all non-directory) entries only.
-@@ -60,10 +60,10 @@ Recursively display directories. This w
+@@ -60,10 +60,10 @@
follow deleted directories, because it can't.
.IP "-s seconds"
The time skew of the original system in seconds. For example, if the
@@ -211,8 +205,8 @@ diff -Naurp sleuthkit.orig/man/fls.1 sleuthkit/man/fls.1
+Identify the type of image file, such as raw or split. Use '\-i list' to list the supported types.
If not given, autodetection methods are used.
.IP "-o imgoffset"
- The sector offset where the file system starts in the image. Non-512 byte
-@@ -79,7 +79,7 @@ The ASCII string of the time zone of the
+ The sector offset where the file system starts in the image.
+@@ -80,7 +80,7 @@
example, EST or GMT. These strings must be defined by your operating
system and may vary.
.IP "image [images]"
@@ -221,7 +215,7 @@ diff -Naurp sleuthkit.orig/man/fls.1 sleuthkit/man/fls.1
.PP
Once the inode has been determined, the file can be recovered using
-@@ -94,27 +94,27 @@ find what file name belongs to an inode,
+@@ -95,27 +95,27 @@
.SH EXAMPLES
To get a list of all files and directories in an image use:
@@ -255,10 +249,9 @@ diff -Naurp sleuthkit.orig/man/fls.1 sleuthkit/man/fls.1
.SH "SEE ALSO"
-diff -Naurp sleuthkit.orig/man/fsstat.1 sleuthkit/man/fsstat.1
---- sleuthkit.orig/man/fsstat.1 2009-07-29 16:35:37.000000000 +0000
-+++ sleuthkit/man/fsstat.1 2009-07-29 17:20:40.000000000 +0000
-@@ -23,10 +23,10 @@ Note that the data is in sectors and not
+--- a/man/fsstat.1
++++ b/man/fsstat.1
+@@ -23,10 +23,10 @@
Print the file system type only.
.IP "-f fstype"
Specify the file system type.
@@ -270,8 +263,8 @@ diff -Naurp sleuthkit.orig/man/fsstat.1 sleuthkit/man/fsstat.1
+Identify the type of image file, such as raw or split. Use '\-i list' to list the supported types.
If not given, autodetection methods are used.
.IP "-o imgoffset"
- The sector offset where the file system starts in the image. Non-512 byte
-@@ -36,7 +36,7 @@ Verbose output of debugging statements t
+ The sector offset where the file system starts in the image.
+@@ -37,7 +37,7 @@
.IP -V
Display version
.IP "image [images]"
@@ -280,10 +273,9 @@ diff -Naurp sleuthkit.orig/man/fsstat.1 sleuthkit/man/fsstat.1
.SH AUTHOR
Brian Carrier <carrier at sleuthkit dot org>
-diff -Naurp sleuthkit.orig/man/hfind.1 sleuthkit/man/hfind.1
---- sleuthkit.orig/man/hfind.1 2009-07-29 16:35:37.000000000 +0000
-+++ sleuthkit/man/hfind.1 2009-07-29 17:20:40.000000000 +0000
-@@ -16,7 +16,7 @@ is known or not. It works with the NIST
+--- a/man/hfind.1
++++ b/man/hfind.1
+@@ -16,7 +16,7 @@
Library (NSRL) and the output of 'md5sum'.
Before the database can be used by 'hfind', an index file must be created
@@ -292,7 +284,7 @@ diff -Naurp sleuthkit.orig/man/hfind.1 sleuthkit/man/hfind.1
This tool is needed for efficiency. Most text-based databases do
not have fixed length entries and are sometimes not sorted. The
-@@ -53,7 +53,7 @@ types of hashes can be given at runtime.
+@@ -53,7 +53,7 @@
uses an index file to perform a binary search for a hash value. This
is much faster than using 'grep', which will do a linear search. Before
a hash database is used, a corresponding index file must be created.
@@ -301,7 +293,7 @@ diff -Naurp sleuthkit.orig/man/hfind.1 sleuthkit/man/hfind.1
The resulting index file will be named based on the database file name.
The name will have the original name following by the hash type (sha1
-@@ -81,7 +81,7 @@ and
+@@ -81,7 +81,7 @@
.SH EXAMPLES
To create an MD5 index file for NIST NSRL:
@@ -310,7 +302,7 @@ diff -Naurp sleuthkit.orig/man/hfind.1 sleuthkit/man/hfind.1
To lookup a value in the NSRL:
-@@ -91,10 +91,11 @@ To lookup a value in the NSRL:
+@@ -91,10 +91,11 @@
You can even do both SHA-1 and MD5 if you want:
@@ -325,7 +317,7 @@ diff -Naurp sleuthkit.orig/man/hfind.1 sleuthkit/man/hfind.1
76b1f4de1522c20b67acc132937cf82e Hash Not Found
-@@ -104,7 +105,7 @@ To make a database of critical binaries
+@@ -104,7 +105,7 @@
# md5sum /bin/* /sbin/* /usr/bin/* /usr/bin/* /usr/local/bin/* /usr/local/sbin/* > system.md5
@@ -334,7 +326,7 @@ diff -Naurp sleuthkit.orig/man/hfind.1 sleuthkit/man/hfind.1
To look entries up, the following will work:
-@@ -114,7 +115,7 @@ To look entries up, the following will w
+@@ -114,7 +115,7 @@
or
@@ -343,7 +335,7 @@ diff -Naurp sleuthkit.orig/man/hfind.1 sleuthkit/man/hfind.1
928682269cd3edb1acdf9a7f7e606ff2 /bin/bash
-@@ -122,9 +123,9 @@ or
+@@ -122,9 +123,9 @@
or
@@ -355,10 +347,9 @@ diff -Naurp sleuthkit.orig/man/hfind.1 sleuthkit/man/hfind.1
928682269cd3edb1acdf9a7f7e606ff2 /bin/bash
-diff -Naurp sleuthkit.orig/man/icat.1 sleuthkit/man/icat.1
---- sleuthkit.orig/man/icat.1 2009-07-29 16:35:37.000000000 +0000
-+++ sleuthkit/man/icat.1 2009-07-29 17:20:40.000000000 +0000
-@@ -21,7 +21,7 @@ number to standard output.
+--- a/man/icat.1
++++ b/man/icat.1
+@@ -21,7 +21,7 @@
.SH ARGUMENTS
.IP "-f fstype"
Specifies the file system type.
@@ -367,7 +358,7 @@ diff -Naurp sleuthkit.orig/man/icat.1 sleuthkit/man/icat.1
If not given, autodetection methods are used.
.IP -h
Skip over holes in sparse files, so that absolute address information
-@@ -31,7 +31,7 @@ Use file recovery techniques if the file
+@@ -31,7 +31,7 @@
.IP -s
Include the slack space in the output.
.IP "-i imgtype"
@@ -375,8 +366,8 @@ diff -Naurp sleuthkit.orig/man/icat.1 sleuthkit/man/icat.1
+Identify the type of image file, such as raw or split. Use '\-i list' to list the supported types.
If not given, autodetection methods are used.
.IP "-o imgoffset"
- The sector offset where the file system starts in the image. Non-512 byte
-@@ -41,7 +41,7 @@ Enable verbose mode, output to stderr.
+ The sector offset where the file system starts in the image.
+@@ -42,7 +42,7 @@
.IP -V
Display version
.IP "image [images]"
@@ -385,10 +376,9 @@ diff -Naurp sleuthkit.orig/man/icat.1 sleuthkit/man/icat.1
.IP inode
Inode number. \fBicat\fR concatenates the contents of all specified
files.
-diff -Naurp sleuthkit.orig/man/ifind.1 sleuthkit/man/ifind.1
---- sleuthkit.orig/man/ifind.1 2009-07-29 16:35:37.000000000 +0000
-+++ sleuthkit/man/ifind.1 2009-07-29 17:20:40.000000000 +0000
-@@ -17,7 +17,7 @@ the results.
+--- a/man/ifind.1
++++ b/man/ifind.1
+@@ -17,7 +17,7 @@
.SH ARGUMENTS
There are several required and optional arguments. The image file names must be specified each time:
.IP "image [images]"
@@ -397,7 +387,7 @@ diff -Naurp sleuthkit.orig/man/ifind.1 sleuthkit/man/ifind.1
You must also specify what you are looking for and include one of the following:
.IP "-d data_unit"
-@@ -29,7 +29,7 @@ Finds the meta data structure that is po
+@@ -29,7 +29,7 @@
.IP "-p par_inode"
Finds the unallocated MFT entries in an NTFS image that have the given
@@ -406,7 +396,7 @@ diff -Naurp sleuthkit.orig/man/ifind.1 sleuthkit/man/ifind.1
.PP
There are also several optional arguments:
-@@ -37,12 +37,12 @@ There are also several optional argument
+@@ -37,12 +37,12 @@
Find all meta-data structures (only works when looking with a data_unit).
.IP "-f fstype"
Specify the file system type.
@@ -421,8 +411,8 @@ diff -Naurp sleuthkit.orig/man/ifind.1 sleuthkit/man/ifind.1
+Identify the type of image file, such as raw or split. Use '\-i list' to list the supported types.
If not given, autodetection methods are used.
.IP "-o imgoffset"
- The sector offset where the file system starts in the image. Non-512 byte
-@@ -51,16 +51,16 @@ sectors can be specified using '@' (32 at 2
+ The sector offset where the file system starts in the image.
+@@ -52,16 +52,16 @@
Verbose output to stderr.
.IP -V
Display version.
@@ -444,10 +434,9 @@ diff -Naurp sleuthkit.orig/man/ifind.1 sleuthkit/man/ifind.1
.SH AUTHOR
Brian Carrier <carrier at sleuthkit dot org>
-diff -Naurp sleuthkit.orig/man/ils.1 sleuthkit/man/ils.1
---- sleuthkit.orig/man/ils.1 2009-07-29 16:35:37.000000000 +0000
-+++ sleuthkit/man/ils.1 2009-07-29 17:20:40.000000000 +0000
-@@ -36,18 +36,18 @@ Arguments:
+--- a/man/ils.1
++++ b/man/ils.1
+@@ -36,18 +36,18 @@
List every inode in the file system.
.IP "\fB-f\fI fstype\fR"
Specifies the file system type.
@@ -469,7 +458,7 @@ diff -Naurp sleuthkit.orig/man/ils.1 sleuthkit/man/ils.1
.IP \fB-p\fR
Display orphan inodes (unallocated with no file name)
.IP \fB-r\fR
-@@ -55,7 +55,7 @@ Display orphan inodes (unallocated with
+@@ -55,7 +55,7 @@
for \fB-LZ\fR
(see the \fBfine controls\fR section below).
.IP "-i imgtype"
@@ -477,8 +466,8 @@ diff -Naurp sleuthkit.orig/man/ils.1 sleuthkit/man/ils.1
+Identify the type of image file, such as raw or split. Use '\-i list' to list the supported types.
If not given, autodetection methods are used.
.IP "-o imgoffset"
- The sector offset where the file system starts in the image. Non-512 byte
-@@ -65,7 +65,7 @@ Turn on verbose mode, output to stderr.
+ The sector offset where the file system starts in the image.
+@@ -66,7 +66,7 @@
.IP \fB-V\fR
Display Version.
.IP "image [images]"
@@ -487,38 +476,18 @@ diff -Naurp sleuthkit.orig/man/ils.1 sleuthkit/man/ils.1
.IP "\fIstart-stop\fR"
Examine the specified inode number or number range.
.PP
-diff -Naurp sleuthkit.orig/man/img_cat.1 sleuthkit/man/img_cat.1
---- sleuthkit.orig/man/img_cat.1 2009-07-29 16:35:37.000000000 +0000
-+++ sleuthkit/man/img_cat.1 2009-07-29 17:20:40.000000000 +0000
-@@ -13,13 +13,13 @@ the appropriate tool.
-
- .SH ARGUMENTS
- .IP "-i imgtype"
--Identify the type of image file, such as raw, split, or aff. Use '-i list' to list the supported types. If not given, autodetection methods are used.
-+Identify the type of image file, such as raw, split, or aff. Use '\-i list' to list the supported types. If not given, autodetection methods are used.
- .IP -v
- Verbose output of debugging statements to stderr
- .IP -V
- Display version
- .IP "image [images]"
--One (or more if split) disk or partition images whose format is given with '-i'.
-+One (or more if split) disk or partition images whose format is given with '\-i'.
-
- .SH AUTHOR
- Brian Carrier <carrier at sleuthkit dot org>
-diff -Naurp sleuthkit.orig/man/img_stat.1 sleuthkit/man/img_stat.1
---- sleuthkit.orig/man/img_stat.1 2009-07-29 16:35:37.000000000 +0000
-+++ sleuthkit/man/img_stat.1 2009-07-29 17:20:40.000000000 +0000
-@@ -12,7 +12,7 @@ and the byte range of each file will be
+--- a/man/img_stat.1
++++ b/man/img_stat.1
+@@ -12,7 +12,7 @@
.SH ARGUMENTS
.IP "-i imgtype"
-Identify the type of image file, such as raw or split. Use '-i list' to list the supported types. If not given, autodetection methods are used.
+Identify the type of image file, such as raw or split. Use '\-i list' to list the supported types. If not given, autodetection methods are used.
+ .IP "-b dev_sector_size"
+ The size, in bytes, of the underlying device sectors. If not given, the value in the image format is used (if it exists) or 512-bytes is assumed.
.IP "-t"
- Print the image type only.
- .IP -v
-@@ -20,7 +20,7 @@ Verbose output of debugging statements t
+@@ -22,7 +22,7 @@
.IP -V
Display version
.IP "image [images]"
@@ -527,10 +496,9 @@ diff -Naurp sleuthkit.orig/man/img_stat.1 sleuthkit/man/img_stat.1
.SH AUTHOR
Brian Carrier <carrier at sleuthkit dot org>
-diff -Naurp sleuthkit.orig/man/istat.1 sleuthkit/man/istat.1
---- sleuthkit.orig/man/istat.1 2009-07-29 16:35:37.000000000 +0000
-+++ sleuthkit/man/istat.1 2009-07-29 17:20:40.000000000 +0000
-@@ -23,13 +23,13 @@ Display the addresses of num disk units.
+--- a/man/istat.1
++++ b/man/istat.1
+@@ -23,13 +23,13 @@
unallocated with size 0, but still has block pointers.
.IP "-f fstype"
Specify the file system type.
@@ -546,8 +514,8 @@ diff -Naurp sleuthkit.orig/man/istat.1 sleuthkit/man/istat.1
+Identify the type of image file, such as raw or split. Use '\-i list' to list the supported types.
If not given, autodetection methods are used.
.IP "-o imgoffset"
- The sector offset where the file system starts in the image. Non-512 byte
-@@ -43,7 +43,7 @@ An ASCII string of the original system's
+ The sector offset where the file system starts in the image.
+@@ -44,7 +44,7 @@
GMT. These strings are defined by the operating system and may
vary. NOTE: This has changed since TCTUTILs.
.IP "image [images]"
@@ -556,10 +524,9 @@ diff -Naurp sleuthkit.orig/man/istat.1 sleuthkit/man/istat.1
.IP inode
Meta-data number to display stats on
-diff -Naurp sleuthkit.orig/man/jcat.1 sleuthkit/man/jcat.1
---- sleuthkit.orig/man/jcat.1 2009-07-29 16:35:37.000000000 +0000
-+++ sleuthkit/man/jcat.1 2009-07-29 17:20:40.000000000 +0000
-@@ -20,9 +20,9 @@ a file system block. The raw output is
+--- a/man/jcat.1
++++ b/man/jcat.1
+@@ -20,9 +20,9 @@
.SH ARGUMENTS
.IP "-f fstype"
@@ -569,9 +536,9 @@ diff -Naurp sleuthkit.orig/man/jcat.1 sleuthkit/man/jcat.1
-Identify the type of image file, such as raw or split. Use '-i list' to list the supported types. If not given, autodetection methods are used.
+Identify the type of image file, such as raw or split. Use '\-i list' to list the supported types. If not given, autodetection methods are used.
.IP "-o imgoffset"
- The sector offset where the file system starts in the image. Non-512 byte
- sectors can be specified using '@' (32 at 2048).
-@@ -30,8 +30,8 @@ sectors can be specified using '@' (32 at 2
+ The sector offset where the file system starts in the image.
+ .IP "-b dev_sector_size"
+@@ -31,8 +31,8 @@
Display version
.IP -v
verbose output
@@ -582,7 +549,7 @@ diff -Naurp sleuthkit.orig/man/jcat.1 sleuthkit/man/jcat.1
.IP [inode]
The inode where the file system journal can be found.
-@@ -40,7 +40,7 @@ The journal block to display.
+@@ -41,7 +41,7 @@
.SH "EXAMPLES"
@@ -591,10 +558,9 @@ diff -Naurp sleuthkit.orig/man/jcat.1 sleuthkit/man/jcat.1
.SH AUTHOR
Brian Carrier <carrier at sleuthkit dot org>
-diff -Naurp sleuthkit.orig/man/jls.1 sleuthkit/man/jls.1
---- sleuthkit.orig/man/jls.1 2009-07-29 16:35:37.000000000 +0000
-+++ sleuthkit/man/jls.1 2009-07-29 17:20:40.000000000 +0000
-@@ -17,9 +17,9 @@ description.
+--- a/man/jls.1
++++ b/man/jls.1
+@@ -17,9 +17,9 @@
.SH ARGUMENTS
.IP "-f fstype"
Specify the file system type.
@@ -604,9 +570,9 @@ diff -Naurp sleuthkit.orig/man/jls.1 sleuthkit/man/jls.1
-Identify the type of image file, such as raw or split. Use '-i list' to list the supported types. If not given, autodetection methods are used.
+Identify the type of image file, such as raw or split. Use '\-i list' to list the supported types. If not given, autodetection methods are used.
.IP "-o imgoffset"
- The sector offset where the file system starts in the image. Non-512 byte
- sectors can be specified using '@' (32 at 2048).
-@@ -28,13 +28,13 @@ Display version
+ The sector offset where the file system starts in the image.
+ .IP "-b dev_sector_size"
+@@ -29,13 +29,13 @@
.IP -v
verbose output
.IP "image [images]"
@@ -622,10 +588,9 @@ diff -Naurp sleuthkit.orig/man/jls.1 sleuthkit/man/jls.1
.SH AUTHOR
Brian Carrier <carrier at sleuthkit dot org>
-diff -Naurp sleuthkit.orig/man/mactime.1 sleuthkit/man/mactime.1
---- sleuthkit.orig/man/mactime.1 2009-07-29 16:35:37.000000000 +0000
-+++ sleuthkit/man/mactime.1 2009-07-29 17:20:40.000000000 +0000
-@@ -16,14 +16,14 @@ mactime \- Create an ASCII time line of
+--- a/man/mactime.1
++++ b/man/mactime.1
+@@ -16,14 +16,14 @@
.SH DESCRIPTION
.B mactime
creates an ASCII time line of file activity based on the body file
@@ -643,7 +608,7 @@ diff -Naurp sleuthkit.orig/man/mactime.1 sleuthkit/man/mactime.1
tools can also be used to generate the file.
.IP "-g group file"
Specify the location of the group file. mactime will display the group
-@@ -34,7 +34,7 @@ user name instead of the UID of this is
+@@ -34,7 +34,7 @@
.IP "-i day|hour index file"
Specify the location of an index file to write to. The first argument
specifies the granularity, either an hourly summary or daily. If the
@@ -652,10 +617,9 @@ diff -Naurp sleuthkit.orig/man/mactime.1 sleuthkit/man/mactime.1
import into a spread sheet.
.IP -d
Display timeline and index files in comma delimited format. This is used
-diff -Naurp sleuthkit.orig/man/mmcat.1 sleuthkit/man/mmcat.1
---- sleuthkit.orig/man/mmcat.1 2009-07-29 16:35:37.000000000 +0000
-+++ sleuthkit/man/mmcat.1 2009-07-29 17:20:40.000000000 +0000
-@@ -17,7 +17,7 @@ extract the contents of a partition to a
+--- a/man/mmcat.1
++++ b/man/mmcat.1
+@@ -17,7 +17,7 @@
.SH ARGUMENTS
.IP "-t mmtype"
@@ -664,7 +628,7 @@ diff -Naurp sleuthkit.orig/man/mmcat.1 sleuthkit/man/mmcat.1
.IP "-o offset"
Specify the offset into the image where the volume containing the
partition system starts. The relative offset of the partition system
-@@ -29,7 +29,7 @@ Verbose output of debugging statements t
+@@ -31,7 +31,7 @@
.IP -V
Display version
.IP "image [images]"
@@ -673,10 +637,9 @@ diff -Naurp sleuthkit.orig/man/mmcat.1 sleuthkit/man/mmcat.1
.IP "part_num"
Address of partition to process. See the mmls output to determine the address of the partitions.
-diff -Naurp sleuthkit.orig/man/mmls.1 sleuthkit/man/mmls.1
---- sleuthkit.orig/man/mmls.1 2009-07-29 16:35:37.000000000 +0000
-+++ sleuthkit/man/mmls.1 2009-07-29 17:20:40.000000000 +0000
-@@ -17,7 +17,7 @@ tables and disk labels.
+--- a/man/mmls.1
++++ b/man/mmls.1
+@@ -17,7 +17,7 @@
.SH ARGUMENTS
.IP "-t mmtype"
@@ -685,7 +648,7 @@ diff -Naurp sleuthkit.orig/man/mmls.1 sleuthkit/man/mmls.1
.IP "-o offset"
Specify the offset into the image where the volume containing the
partition system starts. The relative offset of the partition system
-@@ -41,10 +41,10 @@ Show metadata volumes
+@@ -43,10 +43,10 @@
.IP -M
Hide metadata volumes
.IP "image [images]"
@@ -698,25 +661,16 @@ diff -Naurp sleuthkit.orig/man/mmls.1 sleuthkit/man/mmls.1
Namely, it will show which sectors are not being used so that those
can be searched for hidden data. It also gives the length value so
that it can be plugged into 'dd' more easily for extracting the
-@@ -52,7 +52,7 @@ partitions. It also will show BSD disk
+@@ -54,7 +54,7 @@
NetBSD and will display the output in sectors and not cylinders.
Lastly, it works on non-Linux systems.
-If none of -a, -A, -m, or -M are given then all volume types will
+If none of \-a, \-A, \-m, or \-M are given then all volume types will
be listed. If any of them are given, then only the types specified
- on the command line will be listed. Allocated volumes are those
- that are listed in a partition table in the volume system. Unallocated
-@@ -61,7 +61,7 @@ have not been allocated to a volume. Th
- the allocated and unallocated volumes and describe where the partition
- tables and other metadata structures are located. In some volume
- systems, these structures are in allocated space and in others they
--are in unallocated space. They can be hidden with -M.
-+are in unallocated space. They can be hidden with \-M.
+ on the command line will be listed.
- .SH "EXAMPLES"
- To list the partition table of a Windows system using autodetect:
-@@ -70,7 +70,7 @@ To list the partition table of a Windows
+@@ -76,7 +76,7 @@
To list the contents of a BSD system that starts in sector 12345 of a split image:
@@ -725,10 +679,9 @@ diff -Naurp sleuthkit.orig/man/mmls.1 sleuthkit/man/mmls.1
.SH AUTHOR
Brian Carrier <carrier at sleuthkit dot org>
-diff -Naurp sleuthkit.orig/man/mmstat.1 sleuthkit/man/mmstat.1
---- sleuthkit.orig/man/mmstat.1 2009-07-29 16:35:37.000000000 +0000
-+++ sleuthkit/man/mmstat.1 2009-07-29 17:20:40.000000000 +0000
-@@ -17,7 +17,7 @@ tables and disk labels. Mainly, the typ
+--- a/man/mmstat.1
++++ b/man/mmstat.1
+@@ -17,7 +17,7 @@
.SH ARGUMENTS
.IP "-t mmtype"
@@ -737,7 +690,7 @@ diff -Naurp sleuthkit.orig/man/mmstat.1 sleuthkit/man/mmstat.1
.IP "-o offset"
Specify the offset into the image where the volume containing the
partition system starts. The relative offset of the partition system
-@@ -29,7 +29,7 @@ Verbose output of debugging statements t
+@@ -31,7 +31,7 @@
.IP -V
Display version
.IP "image [images]"
@@ -746,10 +699,9 @@ diff -Naurp sleuthkit.orig/man/mmstat.1 sleuthkit/man/mmstat.1
.SH AUTHOR
Brian Carrier <carrier at sleuthkit dot org>
-diff -Naurp sleuthkit.orig/man/sigfind.1 sleuthkit/man/sigfind.1
---- sleuthkit.orig/man/sigfind.1 2009-07-29 16:35:37.000000000 +0000
-+++ sleuthkit/man/sigfind.1 2009-07-29 17:20:40.000000000 +0000
-@@ -33,15 +33,16 @@ The signature is stored in little-endian
+--- a/man/sigfind.1
++++ b/man/sigfind.1
+@@ -33,15 +33,16 @@
.IP -V
Display version
.IP [hex_signature]
@@ -769,10 +721,9 @@ diff -Naurp sleuthkit.orig/man/sigfind.1 sleuthkit/man/sigfind.1
.SH AUTHOR
-diff -Naurp sleuthkit.orig/man/sorter.1 sleuthkit/man/sorter.1
---- sleuthkit.orig/man/sorter.1 2009-07-29 16:35:37.000000000 +0000
-+++ sleuthkit/man/sorter.1 2009-07-29 17:20:40.000000000 +0000
-@@ -37,17 +37,17 @@ system.
+--- a/man/sorter.1
++++ b/man/sorter.1
+@@ -37,17 +37,17 @@
.SH ARGUMENTS
The required arguments are as follows. This will analyze one or more
@@ -795,7 +746,7 @@ diff -Naurp sleuthkit.orig/man/sorter.1 sleuthkit/man/sorter.1
.IP images
The file names of the image(s) to analyze.
-@@ -77,7 +77,7 @@ have priority over the standard files.
+@@ -77,7 +77,7 @@
Specify the location of the ONLY configuration file. The standard config
files will not be loaded if this option is given. For example, in the
\'share/sort\' directory there is a file called 'images.sort'. This file
@@ -804,7 +755,7 @@ diff -Naurp sleuthkit.orig/man/sorter.1 sleuthkit/man/sorter.1
only images will be saved about the image.
.IP "-m mnt"
Specify the mounting point of the image being analyzed. This is only
-@@ -119,8 +119,8 @@ This will be done automatically when any
+@@ -119,8 +119,8 @@
Calculate the SHA-1 value for each file and save it in the category file.
.IP -s
Save the actual file content to sub-directories in the directory
@@ -815,7 +766,7 @@ diff -Naurp sleuthkit.orig/man/sorter.1 sleuthkit/man/sorter.1
graphic images are also created.
.IP -v
Display verbose information
-@@ -136,7 +136,7 @@ can be given.
+@@ -136,7 +136,7 @@
is a Perl script that interacts with other The Sleuth Kit tools. It starts
by reading the configuration files from the installation directory.
There is a general configuration file and a specific one for each
@@ -824,7 +775,7 @@ diff -Naurp sleuthkit.orig/man/sorter.1 sleuthkit/man/sorter.1
flag. Each configuration file contains rules for processing the
output of the 'file' command. One type of line identifies which
category (i.e. 'images') a given 'file' output belongs to (i.e.
-@@ -157,7 +157,7 @@ The 'file' command is then run to identi
+@@ -157,7 +157,7 @@
header information).
The configuration file rules are used to identify which category
it belongs to. An entry is added to the corresponding category
@@ -833,7 +784,7 @@ diff -Naurp sleuthkit.orig/man/sorter.1 sleuthkit/man/sorter.1
a copy of the file is saved in a subdirectory of the same name as
the category. If the HTML format is used, then hyper-links will
allow one to easily view saved files and view what is in each
-@@ -168,9 +168,9 @@ category and the 'data' category. 'data
+@@ -168,9 +168,9 @@
structure that 'file' does not know and 'unknown' is for files with
a structure that 'file' knows about. These are saved for future
reference, but the unknown category can be ignored by using
@@ -845,7 +796,7 @@ diff -Naurp sleuthkit.orig/man/sorter.1 sleuthkit/man/sorter.1
then the files are saved in a subdirectory that is named with
the category name. Each file is named using the file system image
name followed by the meta data address and the original file
-@@ -207,7 +207,7 @@ The 'default.sort' file is used by any f
+@@ -207,7 +207,7 @@
entries for common file types. A specific operating system file also
exists, which is useful for extensions that are specific to a given OS.
By default, the default file and the OS specific one will be used. Using
@@ -854,7 +805,7 @@ diff -Naurp sleuthkit.orig/man/sorter.1 sleuthkit/man/sorter.1
then only the supplied configuration file is used.
There are two rule types in the configuration files. Each rule starts
-@@ -262,22 +262,22 @@ and I will incorporate them into future
+@@ -262,22 +262,22 @@
.SH EXAMPLES
To run sorter with no hash databases, the following can be used:
@@ -884,3 +835,23 @@ diff -Naurp sleuthkit.orig/man/sorter.1 sleuthkit/man/sorter.1
.SH REQUIREMENTS
The NIST National Software Reference Library (NSRL) can be found at
+--- a/man/img_cat.1
++++ b/man/img_cat.1
+@@ -13,7 +13,7 @@
+
+ .SH ARGUMENTS
+ .IP "-i imgtype"
+-Identify the type of image file, such as raw, split, or aff. Use '-i list' to list the supported types. If not given, autodetection methods are used.
++Identify the type of image file, such as raw, split, or aff. Use '\-i list' to list the supported types. If not given, autodetection methods are used.
+ .IP "-b dev_sector_size"
+ The size, in bytes, of the underlying device sectors. If not given, the value in the image format is used (if it exists) or 512-bytes is assumed.
+ .IP -v
+@@ -21,7 +21,7 @@
+ .IP -V
+ Display version
+ .IP "image [images]"
+-One (or more if split) disk or partition images whose format is given with '-i'.
++One (or more if split) disk or partition images whose format is given with '\-i'.
+
+ .SH AUTHOR
+ Brian Carrier <carrier at sleuthkit dot org>
diff --git a/debian/patches/10_fix_compiler_warnings.patch b/debian/patches/10_fix_compiler_warnings.patch
deleted file mode 100644
index 985ae4a..0000000
--- a/debian/patches/10_fix_compiler_warnings.patch
+++ /dev/null
@@ -1,69 +0,0 @@
-Author: Cristian Greco <cristian.debian at gmail.com>
-Description: Fix a lot of compiler warnings (pulled from upstream svn).
---- a/tsk3/fs/fatfs.c
-+++ b/tsk3/fs/fatfs.c
-@@ -778,7 +778,7 @@
- "Volume Label (Root Directory): %c%c%c%c%c%c%c%c%c%c%c\n",
- de->name[0], de->name[1], de->name[2], de->name[3],
- de->name[4], de->name[5], de->name[6], de->name[7],
-- de->name[8], de->name[9], de->name[10]);
-+ de->ext[0], de->ext[1], de->ext[2]);
- }
- else {
- tsk_fprintf(hFile, "Volume Label (Root Directory):\n");
-@@ -818,7 +818,7 @@
- "Volume Label (Root Directory): %c%c%c%c%c%c%c%c%c%c%c\n",
- de->name[0], de->name[1], de->name[2], de->name[3],
- de->name[4], de->name[5], de->name[6], de->name[7],
-- de->name[8], de->name[9], de->name[10]);
-+ de->ext[0], de->ext[1], de->ext[2]);
- }
- else {
- tsk_fprintf(hFile, "Volume Label (Root Directory):\n");
---- a/tsk3/fs/ntfs.c
-+++ b/tsk3/fs/ntfs.c
-@@ -1616,8 +1616,8 @@
- }
-
- /* Make sure it is NULL Terminated */
-- else if ((uintptr_t) name8 > (uintptr_t) name + sizeof(name))
-- name[sizeof(name)] = '\0';
-+ else if ((uintptr_t) name8 >= (uintptr_t) name + sizeof(name))
-+ name[sizeof(name) - 1] = '\0';
- else
- *name8 = '\0';
-
-@@ -1992,9 +1992,9 @@
- *name8 = '\0';
- }
- /* Make sure it is NULL Terminated */
-- else if ((uintptr_t) name8 >
-+ else if ((uintptr_t) name8 >=
- (uintptr_t) fs_name->name + sizeof(fs_name->name))
-- fs_name->name[sizeof(fs_name->name)] = '\0';
-+ fs_name->name[sizeof(fs_name->name) - 1] = '\0';
- else
- *name8 = '\0';
-
-@@ -3636,8 +3636,8 @@
- }
-
- /* Make sure it is NULL Terminated */
-- else if ((uintptr_t) name8 > (uintptr_t) asc + sizeof(asc))
-- asc[sizeof(asc)] = '\0';
-+ else if ((uintptr_t) name8 >= (uintptr_t) asc + sizeof(asc))
-+ asc[sizeof(asc) - 1] = '\0';
- else
- *name8 = '\0';
- tsk_fprintf(hFile, "Volume Name: %s\n", asc);
-@@ -3719,8 +3719,8 @@
- }
-
- /* Make sure it is NULL Terminated */
-- else if ((uintptr_t) name8 > (uintptr_t) asc + sizeof(asc))
-- asc[sizeof(asc)] = '\0';
-+ else if ((uintptr_t) name8 >= (uintptr_t) asc + sizeof(asc))
-+ asc[sizeof(asc) - 1] = '\0';
- else
- *name8 = '\0';
- tsk_fprintf(hFile, "%s (%" PRIu32 ") ",
diff --git a/debian/patches/series b/debian/patches/series
index 258dd0a..ca7da3d 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,4 +1,3 @@
01-fix-hfind-manpage.patch
02-fix-hyphens-manpages.patch
-10_fix_compiler_warnings.patch
90_fix_ldflags.patch
--
debian-forensics/sleuthkit
More information about the forensics-changes
mailing list