void TskFile::initialize()
{
TskImgDB * imgDB = &TskServices::Instance().getImgDB();
// XXX We never check the return value...
if (imgDB != NULL)
imgDB->getFileRecord(m_id, m_fileRecord);
}
void TskFile::initialize()
{
TskImgDB * imgDB = &TskServices::Instance().getImgDB();
// getDB will throw exception if ImgDB has not been setup
if (imgDB != NULL) {
if (imgDB->getFileRecord(m_id, m_fileRecord)) {
throw TskException("TskFile::initialize: Error looking up file: " + m_id);
}
}
}
int TskCarveExtractScalpel::processFile(int unallocImgId)
{
TskImgDB *imgDB = NULL;
try
{
imgDB = &TskServices::Instance().getImgDB();
// Get the input folder path. The file to carve resides in a subdirectory of the carve prep output folder. The name of the subdirectory is the unallocated image file id.
std::string carvePrepOutputPath = GetSystemProperty("CARVE_DIR");
if (!Poco::File(carvePrepOutputPath).exists())
{
std::stringstream msg;
msg << "TskCarveExtractScalpel::processFile : specified carve prep output folder '" << carvePrepOutputPath << "' does not exist";
throw TskException(msg.str());
}
std::stringstream inputFolderPathBuilder;
inputFolderPathBuilder << carvePrepOutputPath << Poco::Path::separator() << unallocImgId;
// Get the input file name and construct the input file path. All of the files to carve have the same name.
std::string carvePrepOutputFileName = GetSystemProperty("UNALLOC_SECTORS_IMG_FILE_NAME");
std::stringstream unallocImgFilePathBuilder;
unallocImgFilePathBuilder << inputFolderPathBuilder.str() << Poco::Path::separator() << carvePrepOutputFileName;
Poco::File unallocImgFile(unallocImgFilePathBuilder.str());
if (!unallocImgFile.exists())
{
std::stringstream msg;
msg << "TskCarveExtractScalpel::processFile : did not find unalloc img file number " << unallocImgId << " at '" << unallocImgFilePathBuilder.str() << "'";
throw TskException(msg.str());
}
if (unallocImgFile.getSize() > static_cast<Poco::File::FileSize>(0))
{
// Attempt to carve the file, storing the carved files in a subdirectory of the input folder and the Scalpel console output in the input folder.
// The console output is placed in the input folder rather than the output folder because Scalpel will only write to an empty directory.
std::stringstream outputFolderPath;
outputFolderPath << inputFolderPathBuilder.str() << Poco::Path::separator() << CARVED_FILES_FOLDER;
std::stringstream stdOutFilePath;
stdOutFilePath << inputFolderPathBuilder.str() << Poco::Path::separator() << STD_OUT_DUMP_FILE_NAME;
std::stringstream stdErrFilePath;
stdErrFilePath << inputFolderPathBuilder.str() << Poco::Path::separator() << STD_ERR_DUMP_FILE_NAME;
carveFile(unallocImgFilePathBuilder.str(), outputFolderPath.str(), stdOutFilePath.str(), stdErrFilePath.str());
// Scalpel lists any files it carves out in a results file. Use the file list to add the files to the image DB and copy them to file storage.
std::stringstream resultsFilePath;
resultsFilePath << outputFolderPath.str() << Poco::Path::separator() << SCALPEL_RESULTS_FILE_NAME;
processCarvedFiles(outputFolderPath.str(), parseCarvingResultsFile(unallocImgId, resultsFilePath.str()));
// Update the unused sector info in the image database so it is known which of the unallocated sectors just carved did not go into a carved file.
if (m_createUnusedSectorFiles)
{
std::vector<TskUnusedSectorsRecord> unusedSectorsList;
imgDB->addUnusedSectors(unallocImgId, unusedSectorsList);
}
}
else
{
// There is nothing to do if the file to be carved is of length zero.
imgDB->setUnallocImgStatus(unallocImgId, TskImgDB::IMGDB_UNALLOC_IMG_STATUS_CARVED_NOT_NEEDED);
}
return 0;
}
catch (TskException &ex)
{
LOGERROR(TskUtilities::toUTF16(ex.message()));
if (imgDB)
{
imgDB->setUnallocImgStatus(unallocImgId, TskImgDB::IMGDB_UNALLOC_IMG_STATUS_CARVED_ERR);
}
return 1;
}
}
