--sparse and holes at the end of files

[Chris Calabrese]

Hi.

I'm investigating using --sparse in GNU cpio (2.4.2 from RedHat 7.1) and 
GNU tar (1.13.19 from RedHat 7.1) as part of  my assignment for 
acheiving a GIAC Certified Forensic Analyst certification from the SANS 
Institute.

My analysis is that --sparse is fairly useless in GNU tar, and mostly 
works in GNU cpio, but that holes at the end of a file don't get created 
(I'm guessing the appropriate lseek is done, but no final write is ever 
done).

I see that GNU cpio 2.5 was *just* released.  Do you know if happens to 
address this problem?  I don't see anything in the change log, but there 
is an entry that lots of changes were taken from the various Linux 
distributions.

Yes, I know I should get the code and try it out, but I thought I'd ask 
first.  Beside, if you don't know about this... now you do.

Thanks greatly.

--
Chris Calabrese, GCIA
Internet Security Analyst
MerckMedco.com