pytsk/libtsk does not correctly/fully handle ext2, ext3, ext4

[joachimmetz]

libtsk (and therefore pytsk) does not correctly handle ext2, ext3, ext4. Issues reported to upstream:

• https://github.com/sleuthkit/sleuthkit/issues/1979 incorrect handling of inline data
• https://github.com/sleuthkit/sleuthkit/issues/1980 incorrect handling of inline data
• https://github.com/sleuthkit/sleuthkit/issues/2002 incorrect handling of implicit sparse extent
• https://github.com/sleuthkit/sleuthkit/issues/2009 incorrect handling of uninitialized extent
• sleuthkit 4.10.1 was released - changes to attempt upgrade of pytsk https://github.com/py4n6/pytsk/pull/69 - still issues with mix of C and C++ used by libtsk
• https://github.com/sleuthkit/sleuthkit/issues/2487 incorrect handling of extended attributes and extra/extended inode size
• https://github.com/sleuthkit/sleuthkit/issues/2488 no support for large extended attributes (ea_inode)
• https://github.com/py4n6/pytsk/issues/79 unable to retrieve extended attributes with tsk_fs_attrlist_get_idx
• https://github.com/sleuthkit/sleuthkit/issues/2855 possibly incorrectly handling meta_bg feature

[joachimmetz]

pre-release with 4.10 support https://github.com/py4n6/pytsk/releases/tag/20210130

[joachimmetz]

reopened due to new extended attributes related findings https://github.com/sleuthkit/sleuthkit/issues/2487 and https://github.com/sleuthkit/sleuthkit/issues/2488