/**
* \ingroup fslib
* Read the contents of a specific attribute of a file using a typical read() type interface and be
* able specify a specific attribute to read (applies only to file systems with multiple attributes
* per file, such as NTFS). 0s are returned for missing runs of files.
*
* @param a_fs_file The file to read from
* @param a_type The type of attribute to load
* @param a_id The id of attribute to load (use 0 and set a_flags if you do not care)
* @param a_offset The byte offset to start reading from.
* @param a_buf The buffer to read the data into.
* @param a_len The number of bytes to read from the file.
* @param a_flags Flags to use while reading
* @returns The number of bytes read or -1 on error (incl if offset is past EOF).
*/
ssize_t
tsk_fs_file_read_type(TSK_FS_FILE * a_fs_file,
TSK_FS_ATTR_TYPE_ENUM a_type, uint16_t a_id, TSK_OFF_T a_offset,
char *a_buf, size_t a_len, TSK_FS_FILE_READ_FLAG_ENUM a_flags)
{
const TSK_FS_ATTR *fs_attr;
// clean up any error messages that are lying around
tsk_error_reset();
// check the FS_INFO, FS_FILE structures
if ((a_fs_file == NULL) || (a_fs_file->meta == NULL)
|| (a_fs_file->fs_info == NULL)) {
tsk_error_set_errno(TSK_ERR_FS_ARG);
tsk_error_set_errstr
("tsk_fs_file_read: called with NULL pointers");
return -1;
}
else if ((a_fs_file->fs_info->tag != TSK_FS_INFO_TAG)
|| (a_fs_file->meta->tag != TSK_FS_META_TAG)) {
tsk_error_set_errno(TSK_ERR_FS_ARG);
tsk_error_set_errstr
("tsk_fs_file_read: called with unallocated structures");
return -1;
}
if ((fs_attr =
tsk_fs_file_attr_get_type(a_fs_file, a_type, a_id,
(a_flags & TSK_FS_FILE_READ_FLAG_NOID) ? 0 : 1)) == NULL) {
return -1;
}
return tsk_fs_attr_read(fs_attr, a_offset, a_buf, a_len, a_flags);
}
/**
* \ingroup fslib
* Read the contents of a specific attribute of a file using a typical read() type interface.
* 0s are returned for missing runs of files.
*
* @param a_fs_file The inode structure of the file to read.
* @param a_offset The byte offset to start reading from.
* @param a_buf The buffer to read the data into.
* @param a_len The number of bytes to read from the file.
* @param a_flags Flags to use while reading
* @returns The number of bytes read or -1 on error (incl if offset is past EOF).
*/
ssize_t
tsk_fs_file_read(TSK_FS_FILE * a_fs_file,
TSK_OFF_T a_offset, char *a_buf, size_t a_len,
TSK_FS_FILE_READ_FLAG_ENUM a_flags)
{
const TSK_FS_ATTR *fs_attr;
if ((a_fs_file == NULL) || (a_fs_file->fs_info == NULL)) {
tsk_error_set_errno(TSK_ERR_FS_ARG);
tsk_error_set_errstr("tsk_fs_file_read: fs_info is NULL");
return -1;
}
if ((fs_attr = tsk_fs_file_attr_get(a_fs_file)) == NULL) {
return -1;
}
return tsk_fs_attr_read(fs_attr, a_offset, a_buf, a_len, a_flags);
}
int TskImageFileTsk::readFile(const int handle,
const TSK_OFF_T byte_offset,
const size_t byte_len,
char * buffer)
{
TskImageFileTsk::OPEN_FILE * openFile = m_openFiles[handle];
if (openFile == NULL || openFile->fsFile == NULL)
{
std::wstringstream errorMsg;
errorMsg << L"TskImageFileTsk::readFile - Either OPEN_FILE or TSK_FS_FILE is null." << std::endl;
LOGERROR(errorMsg.str());
return -1;
}
// fsAttr can be NULL if the file has no attributes.
if (openFile->fsAttr == NULL || (TSK_OFF_T)byte_offset >= openFile->fsAttr->size)
{
// If the offset is larger than the attribute size then there is nothing left to read.
return 0;
}
int bytesRead = tsk_fs_attr_read(openFile->fsAttr, byte_offset, buffer,
byte_len, TSK_FS_FILE_READ_FLAG_NONE);
if (bytesRead == -1)
{
std::wstringstream errorMsg;
errorMsg << L"TskImageFileTsk::readFile - Error reading file (FS_OFFSET: "
<< openFile->fsFile->fs_info->offset << " - ID: "
<< openFile->fsFile->meta->addr << " - "
<< ((openFile->fsFile->meta->flags & TSK_FS_META_FLAG_ALLOC) ? "Allocated" : "Deleted")
<< ") ("
<< tsk_error_get() << ")" << std::endl;
LOGERROR(errorMsg.str());
}
return bytesRead;
}
