pytsk/libtsk does not correctly/fully handle ext2, ext3, ext4

[joachimmetz]

libtsk (and therefore pytsk) does not correctly handle ext2, ext3, ext4. Issues reported to upstream:

• fls with ext4: multiple errors on inode with inline data sleuthkit/sleuthkit#1979 incorrect handling of inline data
• icat with ext4: error on inode with inline data sleuthkit/sleuthkit#1980 incorrect handling of inline data
• ext4: icat/istat discrepancy between operating system and TSK sleuthkit/sleuthkit#2002 incorrect handling of implicit sparse extent
• ext4: istat/icat do not properly handle uninitialized extent sleuthkit/sleuthkit#2009 incorrect handling of uninitialized extent
• sleuthkit 4.10.1 was released - changes to attempt upgrade of pytsk Updated to Sleuthkit 4.10.1 #71 #69 - still issues with mix of C and C++ used by libtsk
• istat not showing extended attributes stored in inode for ext[2-4] sleuthkit/sleuthkit#2487 incorrect handling of extended attributes and extra/extended inode size
• istat add ext4 large extended attributes (ea_inode) support sleuthkit/sleuthkit#2488 no support for large extended attributes (ea_inode)
• multiple observations of the pytsk/libtsk attribute interface #79 unable to retrieve extended attributes with tsk_fs_attrlist_get_idx
• Ext4: add support for meta_bg feature sleuthkit/sleuthkit#2855 possibly incorrectly handling meta_bg feature
• ext4: native Linux considers out-of-order extents an error case sleuthkit/sleuthkit#3140 handling of out-of-order extents different from native Linux implementation without indication
• ext2: add support for non-utf8 filename encoding / add means to set codepage sleuthkit/sleuthkit#3141 handling of non-UTF8 filenames
• fsstat unable to determine file system type of ext3 or ext4 image with journal_dev sleuthkit/sleuthkit#3387 unable to open ext3 and ext4 file systems with journal_dev
• ext2 with inode size > 128: Missing extra precision in istat output sleuthkit/sleuthkit#3388 ext2 with inode size > 128: Missing extra precision and creation time

[joachimmetz]

pre-release with 4.10 support https://github.com/py4n6/pytsk/releases/tag/20210130

[joachimmetz]

reopened due to new extended attributes related findings sleuthkit/sleuthkit#2487 and sleuthkit/sleuthkit#2488

[joachimmetz]

To do: determine if sleuthkit/sleuthkit#3388 impacts pytsk