aff4 / aff4-cpp-lite Goto Github PK

Hello,
Sorry to use this space to ask a question about usage, but I've looked through documentation and I'm not understanding how to use aff-info, aff-digest, or aff-extract to identify unallocated space, slack space or space between partitions in an aff4 image. In general, I'm not finding a lot of discussion/documentation of how aff4 handles or identifies unallocated space. Any help would be greatly appreciated.

Thanks!

[...]
checking for snappy_compress in -lsnappy... yes
checking for cppunit >= 1.13.0... no
configure: WARNING: Unit Tests disabled - missing cppunit
checking for openssl >= 1.0.2... yes
checking whether C++ compiler accepts -Wall -Wextra -Wpedantic ... yes
checking that generated files are newer than configure... done
configure: error: conditional "HAVE_CPPUNIT" was never defined.
Usually this means the macro was only invoked conditionally.

Shouldn't it just continue when it disabled Unit Tests previously?

To reproduce:

I have been testing 4KB sector support in AFF4-CPP-Lite.

To do this, I created a small disk with 4KB sectors, imaged it using XWF to an E01 file and then converted that to AFF4 using Evimetry. I can see that the 4KB sectors were correctly detected when the E01 was created (in the E01 metadata and the log file) and similarly when Evimetry generated the AFF4 file (in the metadata and the log file). However, when I checked this with the new(ish) AFF4_object_blocksize() method I found that it returns an error. I traced through the code and found that the internal properties collection only seems to contain 2 items and the block size wasn’t one of these.