diff --git a/config/dpkg/changelog b/config/dpkg/changelog index 31752b0c..aaf0e29e 100644 --- a/config/dpkg/changelog +++ b/config/dpkg/changelog @@ -1,5 +1,5 @@ -dfvfs (20210207-1) unstable; urgency=low +dfvfs (20210213-1) unstable; urgency=low * Auto-generated - -- Log2Timeline maintainers Sun, 07 Feb 2021 09:54:02 +0100 + -- Log2Timeline maintainers Sat, 13 Feb 2021 09:54:44 +0100 diff --git a/dfvfs/__init__.py b/dfvfs/__init__.py index 26099803..89010f99 100644 --- a/dfvfs/__init__.py +++ b/dfvfs/__init__.py @@ -6,4 +6,4 @@ storage media types and file formats. """ -__version__ = '20210207' +__version__ = '20210213' diff --git a/dfvfs/lib/tsk_partition.py b/dfvfs/lib/tsk_partition.py index ec465ac9..4e58fc3c 100644 --- a/dfvfs/lib/tsk_partition.py +++ b/dfvfs/lib/tsk_partition.py @@ -145,5 +145,10 @@ def TSKVsPartIsAllocated(tsk_vs_part): # The flags are an instance of TSK_VS_PART_FLAG_ENUM. tsk_vs_part_flags = getattr(tsk_vs_part, 'flags', None) + # For APM partition tables the description needs to be checked to determine + # the usage of the part. + tsk_vs_part_desc = getattr(tsk_vs_part, 'desc', None) + return (tsk_vs_part_flags is not None and - tsk_vs_part_flags == pytsk3.TSK_VS_PART_FLAG_ALLOC) + tsk_vs_part_flags == pytsk3.TSK_VS_PART_FLAG_ALLOC and + tsk_vs_part_desc not in (b'Apple_partition_map', b'Apple_Free'))