Ejemplo n.º 1
0
Archivo: file.c Proyecto: uw-dims/tsk4j
/*
 * Class:     edu_uw_apl_commons_tsk4j_filesys_File
 * Method:    read
 * Signature: (JIIJ[BII)I
 */
JNIEXPORT jint JNICALL 
Java_edu_uw_apl_commons_tsk4j_filesys_File_read__JIIJ_3BII
(JNIEnv * env, jobject thiz, jlong nativePtr, 
 jint type, jint id, jlong offset, jbyteArray buf, jint len, jint flags ) {

  TSK_FS_FILE* info = (TSK_FS_FILE*)nativePtr;
  char* bufC = (char*)malloc( len );
  ssize_t read = tsk_fs_file_read_type( info, type, id, 
										offset, bufC, len, flags );
  if( read != -1 ) 
	(*env)->SetByteArrayRegion( env, buf, 0, read, (const jbyte*)bufC );
  free( bufC );
  return (jint)read;
}
Ejemplo n.º 2
0
int TskImageFileTsk::readFile(const int handle, 
                              const uint64_t byte_offset, 
                              const size_t byte_len, 
                              char * buffer)
{
    TskImageFileTsk::OPEN_FILE * openFile = m_openFiles[handle];

    if (openFile == NULL || openFile->fsFile == NULL)
    {
        std::wstringstream errorMsg;
        errorMsg << L"TskImageFileTsk::readFile - Either OPEN_FILE or TSK_FS_FILE is null." << std::endl;
        LOGERROR(errorMsg.str());
        return -1;
    }

    // fsAttr can be NULL if the file has no attributes.
    if (openFile->fsAttr == NULL || byte_offset >= openFile->fsAttr->size)
    {
        // If the offset is larger than the attribute size then there is nothing left to read.
        return 0;
    }

    int bytesRead = tsk_fs_file_read_type(openFile->fsFile,
                                          static_cast<TSK_FS_ATTR_TYPE_ENUM>(openFile->fsAttr->type),
                                          openFile->fsAttr->id,
                                          byte_offset, buffer, 
                                          byte_len, TSK_FS_FILE_READ_FLAG_NONE);

    if (bytesRead == -1)
    {
        std::wstringstream errorMsg;
        errorMsg << L"TskImageFileTsk::readFile - Error reading file (FS_OFFSET: " 
            << openFile->fsFile->fs_info->offset << " - ID: "
            << openFile->fsFile->meta->addr << " - " 
            << ((openFile->fsFile->meta->flags & TSK_FS_META_FLAG_ALLOC) ? "Allocated" : "Deleted")
            << ") (" 
            << tsk_error_get() << ")" << std::endl;
        LOGERROR(errorMsg.str());
    }

    return bytesRead;
}
Ejemplo n.º 3
0
int TskImageFileTsk::readFile(const int handle, 
                              const uint64_t byte_offset, 
                              const size_t byte_len, 
                              char * buffer)
{
    TskImageFileTsk::OPEN_FILE * openFile = m_openFiles[handle];

    if (openFile == NULL || openFile->fsFile == NULL)
    {
        std::wstringstream errorMsg;
        errorMsg << L"TskImageFileTsk::readFile - Either OPEN_FILE or TSK_FS_FILE is null." << std::endl;
        LOGERROR(errorMsg.str());
        return -1;
    }

    if (byte_offset >= openFile->fsFile->meta->size)
    {
        // If the offset is larger than the file then there is nothing left to read.
        return 0;
    }

    int bytesRead = tsk_fs_file_read_type(openFile->fsFile,
                                          static_cast<TSK_FS_ATTR_TYPE_ENUM>(openFile->attrType),
                                          openFile->attrId,
                                          byte_offset, buffer, 
                                          byte_len, TSK_FS_FILE_READ_FLAG_NONE);

    if (bytesRead == -1)
    {
        std::wstringstream errorMsg;
        errorMsg << L"TskImageFileTsk::readFile - Error reading file: "
            << tsk_error_get() << std::endl;
        LOGERROR(errorMsg.str());
    }

    return bytesRead;
}