/* Determines the encoding mode from a string * Returns 1 if successful or -1 on error */ int unainput_determine_encoding_mode( const system_character_t *string, uint8_t *encoding_mode, libcerror_error_t **error ) { static char *function = "unainput_determine_encoding_mode"; size_t string_length = 0; int result = -1; if( string == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s: invalid string.", function ); return( -1 ); } if( encoding_mode == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s: invalid encoding mode.", function ); return( -1 ); } string_length = system_string_length( string ); if( string_length == 6 ) { if( system_string_compare( string, _SYSTEM_STRING( "decode" ), 6 ) == 0 ) { *encoding_mode = UNACOMMON_ENCODING_MODE_DECODE; result = 1; } else if( system_string_compare( string, _SYSTEM_STRING( "encode" ), 6 ) == 0 ) { *encoding_mode = UNACOMMON_ENCODING_MODE_ENCODE; result = 1; } } return( result ); }
/* Sets the format * Returns 1 if successful, 0 if unsupported value or -1 on error */ int mount_handle_set_format( mount_handle_t *mount_handle, const system_character_t *string, libcerror_error_t **error ) { static char *function = "mount_handle_set_format"; size_t string_length = 0; int result = 0; if( mount_handle == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s: invalid mount handle.", function ); return( -1 ); } string_length = system_string_length( string ); if( string_length == 3 ) { if( system_string_compare( string, _SYSTEM_STRING( "raw" ), 3 ) == 0 ) { mount_handle->input_format = MOUNT_HANDLE_INPUT_FORMAT_RAW; result = 1; } } else if( string_length == 5 ) { if( system_string_compare( string, _SYSTEM_STRING( "files" ), 5 ) == 0 ) { mount_handle->input_format = MOUNT_HANDLE_INPUT_FORMAT_FILES; result = 1; } } return( result ); }
/* Retrieves the handle for a specific path * Returns 1 if successful, 0 if no such handle or -1 on error */ int mount_file_system_get_handle_by_path( mount_file_system_t *file_system, const system_character_t *path, size_t path_length, libvmdk_handle_t **vmdk_handle, libcerror_error_t **error ) { static char *function = "mount_file_system_get_handle_by_path"; system_character_t character = 0; size_t path_index = 0; int handle_index = 0; int result = 0; if( file_system == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s: invalid file system.", function ); return( -1 ); } if( file_system->path_prefix == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_VALUE_MISSING, "%s: invalid file system - missing path prefix.", function ); return( -1 ); } if( path == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s: invalid path.", function ); return( -1 ); } if( path_length > (size_t) ( SSIZE_MAX - 1 ) ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_VALUE_EXCEEDS_MAXIMUM, "%s: invalid path length value exceeds maximum.", function ); return( -1 ); } if( vmdk_handle == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s: invalid handle.", function ); return( -1 ); } path_length = system_string_length( path ); if( ( path_length == 1 ) && ( path[ 0 ] == file_system->path_prefix[ 0 ] ) ) { *vmdk_handle = NULL; return( 1 ); } if( ( path_length < file_system->path_prefix_size ) || ( path_length > ( file_system->path_prefix_size + 3 ) ) ) { return( 0 ); } #if defined( WINAPI ) result = system_string_compare_no_case( path, file_system->path_prefix, file_system->path_prefix_size - 1 ); #else result = system_string_compare( path, file_system->path_prefix, file_system->path_prefix_size - 1 ); #endif if( result != 0 ) { return( 0 ); } handle_index = 0; path_index = file_system->path_prefix_size - 1; while( path_index < path_length ) { character = path[ path_index++ ]; if( ( character < (system_character_t) '0' ) || ( character > (system_character_t) '9' ) ) { return( 0 ); } handle_index *= 10; handle_index += character - (system_character_t) '0'; } handle_index -= 1; if( libcdata_array_get_entry_by_index( file_system->handles_array, handle_index, (intptr_t **) vmdk_handle, error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to retrieve handle: %d.", function, handle_index ); return( -1 ); } return( 1 ); }
/* Determines the database type * Returns 1 if successful or -1 on error */ int database_type_determine( int *database_type, libcdata_array_t *table_names, libcerror_error_t **error ) { int database_types[ NUMBER_OF_DATABASE_TYPES ]; database_type_descriptor_t *database_type_descriptor = NULL; const system_character_t *known_table_name = NULL; system_character_t *table_name = NULL; static char *function = "export_handle_determine_database_type"; size_t known_table_name_length = 0; size_t table_name_length = 0; int database_type_index = 0; int known_table_name_index = 0; int number_of_tables = 0; int table_index = 0; if( database_type == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s: invalid database type.", function ); return( -1 ); } for( database_type_index = 0; database_type_index < NUMBER_OF_DATABASE_TYPES; database_type_index++ ) { database_types[ database_type_index ] = 0; } if( libcdata_array_get_number_of_entries( table_names, &number_of_tables, error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to retrieve number of tables.", function ); return( -1 ); } for( table_index = 0; table_index < number_of_tables; table_index++ ) { if( libcdata_array_get_entry_by_index( table_names, table_index, (intptr_t **) &table_name, error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to retrieve the name of table: %d from array.", function, table_index ); return( -1 ); } if( table_name == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_VALUE_MISSING, "%s: missing name of table: %d.", function, table_index ); return( -1 ); } table_name_length = system_string_length( table_name ); database_type_index = 0; database_type_descriptor = &( database_type_descriptors[ database_type_index++ ] ); while( database_type_descriptor->database_type != DATABASE_TYPE_UNKNOWN ) { known_table_name_index = 0; known_table_name = database_type_descriptor->known_table_names[ known_table_name_index++ ]; while( known_table_name != NULL ) { known_table_name_length = system_string_length( known_table_name ); if( ( known_table_name_length == table_name_length ) && ( system_string_compare( known_table_name, table_name, known_table_name_length ) == 0 ) ) { database_types[ database_type_descriptor->database_type ] += 1; } known_table_name = database_type_descriptor->known_table_names[ known_table_name_index++ ]; } database_type_descriptor = &( database_type_descriptors[ database_type_index++ ] ); } } *database_type = DATABASE_TYPE_UNKNOWN; for( database_type_index = 0; database_type_index < NUMBER_OF_DATABASE_TYPES; database_type_index++ ) { if( database_types[ *database_type ] < database_types[ database_type_index ] ) { *database_type = database_type_index; } } return( 1 ); }
/* Determines the encoding from a string * Returns 1 if successful or -1 on error */ int unainput_determine_encoding( const system_character_t *string, uint8_t *encoding, libcerror_error_t **error ) { static char *function = "unainput_determine_encoding"; size_t string_length = 0; int result = -1; if( string == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s: invalid string.", function ); return( -1 ); } if( encoding == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s: invalid encoding.", function ); return( -1 ); } string_length = system_string_length( string ); if( string_length == 6 ) { if( system_string_compare( string, _SYSTEM_STRING( "base16" ), 6 ) == 0 ) { *encoding = UNACOMMON_ENCODING_BASE16; result = 1; } else if( system_string_compare( string, _SYSTEM_STRING( "base32" ), 6 ) == 0 ) { *encoding = UNACOMMON_ENCODING_BASE32; result = 1; } else if( system_string_compare( string, _SYSTEM_STRING( "base64" ), 6 ) == 0 ) { *encoding = UNACOMMON_ENCODING_BASE64; result = 1; } } else if( string_length == 9 ) { if( system_string_compare( string, _SYSTEM_STRING( "base32hex" ), 9 ) == 0 ) { *encoding = UNACOMMON_ENCODING_BASE32HEX; result = 1; } else if( system_string_compare( string, _SYSTEM_STRING( "base64url" ), 9 ) == 0 ) { *encoding = UNACOMMON_ENCODING_BASE64URL; result = 1; } } return( result ); }
/* Determines the newline conversion from a string * Returns 1 if successful, 0 if unsupported value or -1 on error */ int unainput_determine_newline_conversion( const system_character_t *string, uint8_t *newline_conversion, libcerror_error_t **error ) { static char *function = "unainput_determine_newline_conversion"; size_t string_length = 0; int result = 0; if( string == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s: invalid string.", function ); return( -1 ); } if( newline_conversion == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s: invalid newline conversion.", function ); return( -1 ); } string_length = system_string_length( string ); if( string_length == 2 ) { if( system_string_compare( string, _SYSTEM_STRING( "cr" ), 2 ) == 0 ) { *newline_conversion = UNACOMMON_NEWLINE_CONVERSION_CR; result = 1; } else if( system_string_compare( string, _SYSTEM_STRING( "lf" ), 2 ) == 0 ) { *newline_conversion = UNACOMMON_NEWLINE_CONVERSION_LF; result = 1; } } else if( string_length == 4 ) { if( system_string_compare( string, _SYSTEM_STRING( "none" ), 4 ) == 0 ) { *newline_conversion = UNACOMMON_NEWLINE_CONVERSION_NONE; result = 1; } else if( system_string_compare( string, _SYSTEM_STRING( "crlf" ), 4 ) == 0 ) { *newline_conversion = UNACOMMON_NEWLINE_CONVERSION_CRLF; result = 1; } } return( result ); }
/* Determines the format from a string * Returns 1 if successful or -1 on error */ int unainput_determine_format( const system_character_t *string, uint8_t *format, libcerror_error_t **error ) { static char *function = "unainput_determine_format"; size_t string_length = 0; int result = -1; if( string == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s: invalid string.", function ); return( -1 ); } if( format == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s: invalid format.", function ); return( -1 ); } string_length = system_string_length( string ); if( string_length == 4 ) { if( system_string_compare( string, _SYSTEM_STRING( "utf7" ), 4 ) == 0 ) { *format = UNACOMMON_FORMAT_UTF7; result = 1; } else if( system_string_compare( string, _SYSTEM_STRING( "utf8" ), 4 ) == 0 ) { *format = UNACOMMON_FORMAT_UTF8; result = 1; } } else if( string_length == 7 ) { if( system_string_compare( string, _SYSTEM_STRING( "utf16be" ), 7 ) == 0 ) { *format = UNACOMMON_FORMAT_UTF16BE; result = 1; } else if( system_string_compare( string, _SYSTEM_STRING( "utf16le" ), 7 ) == 0 ) { *format = UNACOMMON_FORMAT_UTF16LE; result = 1; } else if( system_string_compare( string, _SYSTEM_STRING( "utf32be" ), 7 ) == 0 ) { *format = UNACOMMON_FORMAT_UTF32BE; result = 1; } else if( system_string_compare( string, _SYSTEM_STRING( "utf32le" ), 7 ) == 0 ) { *format = UNACOMMON_FORMAT_UTF32LE; result = 1; } } else if( string_length == 11 ) { if( system_string_compare( string, _SYSTEM_STRING( "byte-stream" ), 11 ) == 0 ) { *format = UNACOMMON_FORMAT_BYTE_STREAM; result = 1; } else if( system_string_compare( string, _SYSTEM_STRING( "byte_stream" ), 11 ) == 0 ) { *format = UNACOMMON_FORMAT_BYTE_STREAM; result = 1; } } return( result ); }
/* Retrieves a file entry for a specific path * Returns 1 if successful, 0 if no such file entry or -1 on error */ int mount_handle_get_file_entry_by_path( mount_handle_t *mount_handle, const system_character_t *path, mount_file_entry_t **file_entry, libcerror_error_t **error ) { libregf_key_t *regf_key = NULL; libregf_value_t *regf_value = NULL; const system_character_t *filename = NULL; static char *function = "mount_handle_get_file_entry_by_path"; size_t filename_length = 0; size_t key_path_length = 0; size_t last_path_index = 0; size_t path_index = 0; size_t path_length = 0; int file_entry_type = MOUNT_FILE_ENTRY_TYPE_UNKNOWN; int result = 0; if( mount_handle == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s: invalid mount handle.", function ); return( -1 ); } if( path == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s: invalid path.", function ); return( -1 ); } path_length = system_string_length( path ); if( path_length == 0 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS, "%s: invalid path length value out of bounds.", function ); goto on_error; } if( ( path_length >= 2 ) && ( path[ path_length - 1 ] == LIBCPATH_SEPARATOR ) ) { path_length -= 1; } path_index = path_length; while( path_index > 0 ) { if( path[ path_index ] == LIBCPATH_SEPARATOR ) { break; } path_index--; } /* Ignore the name of the root item */ if( path_length == 0 ) { filename = _SYSTEM_STRING( "" ); filename_length = 0; } else { filename = &( path[ path_index + 1 ] ); filename_length = path_length - ( path_index + 1 ); } if( filename_length == 11 ) { #if defined( WINAPI ) result = system_string_compare_no_case( filename, _SYSTEM_STRING( "(classname)" ), 11 ); #else result = system_string_compare( filename, _SYSTEM_STRING( "(classname)" ), 11 ); #endif if( result == 0 ) { file_entry_type = MOUNT_FILE_ENTRY_TYPE_CLASS_NAME; key_path_length = path_index + 1; } } else if( filename_length == 8 ) { #if defined( WINAPI ) result = system_string_compare_no_case( filename, _SYSTEM_STRING( "(values)" ), 8 ); #else result = system_string_compare( filename, _SYSTEM_STRING( "(values)" ), 8 ); #endif if( result == 0 ) { file_entry_type = MOUNT_FILE_ENTRY_TYPE_VALUES; key_path_length = path_index + 1; } } if( ( file_entry_type == MOUNT_FILE_ENTRY_TYPE_UNKNOWN ) && ( path_index > 0 ) && ( path_length > 10 ) ) { last_path_index = path_index; path_index -= 1; while( path_index > 0 ) { if( path[ path_index ] == LIBCPATH_SEPARATOR ) { break; } path_index--; } if( ( last_path_index - ( path_index + 1 ) ) == 8 ) { #if defined( WINAPI ) result = system_string_compare_no_case( &( path[ path_index + 1 ] ), _SYSTEM_STRING( "(values)" ), 8 ); #else result = system_string_compare( &( path[ path_index + 1 ] ), _SYSTEM_STRING( "(values)" ), 8 ); #endif if( result == 0 ) { file_entry_type = MOUNT_FILE_ENTRY_TYPE_VALUE; key_path_length = path_index + 1; } } } if( file_entry_type == MOUNT_FILE_ENTRY_TYPE_UNKNOWN ) { file_entry_type = MOUNT_FILE_ENTRY_TYPE_KEY; key_path_length = path_length; } result = mount_file_system_get_key_by_path( mount_handle->file_system, path, key_path_length, ®f_key, error ); if( result == -1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to retrieve key.", function ); goto on_error; } else if( result != 0 ) { if( file_entry_type == MOUNT_FILE_ENTRY_TYPE_VALUE ) { result = mount_file_system_get_value_by_filename( mount_handle->file_system, regf_key, filename, filename_length, ®f_value, error ); if( result == -1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_GET_FAILED, "%s: unable to retrieve value.", function ); goto on_error; } } if( result != 0 ) { if( mount_file_entry_initialize( file_entry, mount_handle->file_system, filename, filename_length, file_entry_type, regf_key, regf_value, error ) != 1 ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_RUNTIME, LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED, "%s: unable to initialize file entry.", function ); goto on_error; } } } return( result ); on_error: if( regf_value != NULL ) { libregf_value_free( ®f_value, NULL ); } if( regf_key != NULL ) { libregf_key_free( ®f_key, NULL ); } return( -1 ); }
/* Determines the codepage from a string * Returns 1 if successful, 0 if unsupported value or -1 on error */ int wtcdbinput_determine_ascii_codepage( const system_character_t *string, int *ascii_codepage, libcerror_error_t **error ) { static char *function = "wtcdbinput_determine_ascii_codepage"; size_t string_length = 0; int result = 0; if( string == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s: invalid string.", function ); return( -1 ); } if( ascii_codepage == NULL ) { libcerror_error_set( error, LIBCERROR_ERROR_DOMAIN_ARGUMENTS, LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE, "%s: invalid ASCII codepage.", function ); return( -1 ); } string_length = system_string_length( string ); if( string_length == 5 ) { if( system_string_compare( string, _SYSTEM_STRING( "ascii" ), 5 ) == 0 ) { *ascii_codepage = LIBWTCDB_CODEPAGE_ASCII; result = 1; } } #if defined( HAVE_ISO_CODEPAGES ) if( ( string_length == 10 ) || ( string_length == 11 ) ) { if( system_string_compare( string, _SYSTEM_STRING( "iso" ), 3 ) == 0 ) { if( ( string[ 3 ] != '-' ) && ( string[ 3 ] != '_' ) ) { } else if( system_string_compare( &( string[ 4 ] ), _SYSTEM_STRING( "8859" ), 4 ) == 0 ) { if( ( string[ 8 ] != '-' ) && ( string[ 8 ] != '_' ) ) { } else if( string_length == 10 ) { if( system_string_compare( &( string[ 9 ] ), _SYSTEM_STRING( "1" ), 1 ) == 0 ) { *ascii_codepage = LIBWTCDB_CODEPAGE_ISO_8859_1; result = 1; } else if( system_string_compare( &( string[ 9 ] ), _SYSTEM_STRING( "2" ), 1 ) == 0 ) { *ascii_codepage = LIBWTCDB_CODEPAGE_ISO_8859_2; result = 1; } else if( system_string_compare( &( string[ 9 ] ), _SYSTEM_STRING( "3" ), 1 ) == 0 ) { *ascii_codepage = LIBWTCDB_CODEPAGE_ISO_8859_3; result = 1; } else if( system_string_compare( &( string[ 9 ] ), _SYSTEM_STRING( "4" ), 1 ) == 0 ) { *ascii_codepage = LIBWTCDB_CODEPAGE_ISO_8859_4; result = 1; } else if( system_string_compare( &( string[ 9 ] ), _SYSTEM_STRING( "5" ), 1 ) == 0 ) { *ascii_codepage = LIBWTCDB_CODEPAGE_ISO_8859_5; result = 1; } else if( system_string_compare( &( string[ 9 ] ), _SYSTEM_STRING( "6" ), 1 ) == 0 ) { *ascii_codepage = LIBWTCDB_CODEPAGE_ISO_8859_6; result = 1; } else if( system_string_compare( &( string[ 9 ] ), _SYSTEM_STRING( "7" ), 1 ) == 0 ) { *ascii_codepage = LIBWTCDB_CODEPAGE_ISO_8859_7; result = 1; } else if( system_string_compare( &( string[ 9 ] ), _SYSTEM_STRING( "8" ), 1 ) == 0 ) { *ascii_codepage = LIBWTCDB_CODEPAGE_ISO_8859_8; result = 1; } else if( system_string_compare( &( string[ 9 ] ), _SYSTEM_STRING( "9" ), 1 ) == 0 ) { *ascii_codepage = LIBWTCDB_CODEPAGE_ISO_8859_9; result = 1; } } else if( string_length == 11 ) { if( system_string_compare( &( string[ 9 ] ), _SYSTEM_STRING( "10" ), 2 ) == 0 ) { *ascii_codepage = LIBWTCDB_CODEPAGE_ISO_8859_10; result = 1; } else if( system_string_compare( &( string[ 9 ] ), _SYSTEM_STRING( "11" ), 2 ) == 0 ) { *ascii_codepage = LIBWTCDB_CODEPAGE_ISO_8859_11; result = 1; } else if( system_string_compare( &( string[ 9 ] ), _SYSTEM_STRING( "13" ), 2 ) == 0 ) { *ascii_codepage = LIBWTCDB_CODEPAGE_ISO_8859_13; result = 1; } else if( system_string_compare( &( string[ 9 ] ), _SYSTEM_STRING( "14" ), 2 ) == 0 ) { *ascii_codepage = LIBWTCDB_CODEPAGE_ISO_8859_14; result = 1; } else if( system_string_compare( &( string[ 9 ] ), _SYSTEM_STRING( "15" ), 2 ) == 0 ) { *ascii_codepage = LIBWTCDB_CODEPAGE_ISO_8859_15; result = 1; } else if( system_string_compare( &( string[ 9 ] ), _SYSTEM_STRING( "16" ), 2 ) == 0 ) { *ascii_codepage = LIBWTCDB_CODEPAGE_ISO_8859_16; result = 1; } } } } } #endif if( ( string_length == 11 ) || ( string_length == 12 ) ) { if( system_string_compare( string, _SYSTEM_STRING( "windows" ), 7 ) == 0 ) { if( ( string[ 7 ] != '-' ) && ( string[ 7 ] != '_' ) ) { } else if( string_length == 11 ) { if( system_string_compare( &( string[ 8 ] ), _SYSTEM_STRING( "874" ), 3 ) == 0 ) { *ascii_codepage = LIBWTCDB_CODEPAGE_WINDOWS_874; result = 1; } else if( system_string_compare( &( string[ 8 ] ), _SYSTEM_STRING( "932" ), 3 ) == 0 ) { *ascii_codepage = LIBWTCDB_CODEPAGE_WINDOWS_932; result = 1; } else if( system_string_compare( &( string[ 8 ] ), _SYSTEM_STRING( "936" ), 3 ) == 0 ) { *ascii_codepage = LIBWTCDB_CODEPAGE_WINDOWS_936; result = 1; } } else if( string_length == 12 ) { if( system_string_compare( &( string[ 8 ] ), _SYSTEM_STRING( "1250" ), 4 ) == 0 ) { *ascii_codepage = LIBWTCDB_CODEPAGE_WINDOWS_1250; result = 1; } else if( system_string_compare( &( string[ 8 ] ), _SYSTEM_STRING( "1251" ), 4 ) == 0 ) { *ascii_codepage = LIBWTCDB_CODEPAGE_WINDOWS_1251; result = 1; } else if( system_string_compare( &( string[ 8 ] ), _SYSTEM_STRING( "1252" ), 4 ) == 0 ) { *ascii_codepage = LIBWTCDB_CODEPAGE_WINDOWS_1252; result = 1; } else if( system_string_compare( &( string[ 8 ] ), _SYSTEM_STRING( "1253" ), 4 ) == 0 ) { *ascii_codepage = LIBWTCDB_CODEPAGE_WINDOWS_1253; result = 1; } else if( system_string_compare( &( string[ 8 ] ), _SYSTEM_STRING( "1253" ), 4 ) == 0 ) { *ascii_codepage = LIBWTCDB_CODEPAGE_WINDOWS_1253; result = 1; } else if( system_string_compare( &( string[ 8 ] ), _SYSTEM_STRING( "1254" ), 4 ) == 0 ) { *ascii_codepage = LIBWTCDB_CODEPAGE_WINDOWS_1254; result = 1; } else if( system_string_compare( &( string[ 8 ] ), _SYSTEM_STRING( "1255" ), 4 ) == 0 ) { *ascii_codepage = LIBWTCDB_CODEPAGE_WINDOWS_1255; result = 1; } else if( system_string_compare( &( string[ 8 ] ), _SYSTEM_STRING( "1256" ), 4 ) == 0 ) { *ascii_codepage = LIBWTCDB_CODEPAGE_WINDOWS_1256; result = 1; } else if( system_string_compare( &( string[ 8 ] ), _SYSTEM_STRING( "1257" ), 4 ) == 0 ) { *ascii_codepage = LIBWTCDB_CODEPAGE_WINDOWS_1257; result = 1; } else if( system_string_compare( &( string[ 8 ] ), _SYSTEM_STRING( "1258" ), 4 ) == 0 ) { *ascii_codepage = LIBWTCDB_CODEPAGE_WINDOWS_1258; result = 1; } } } } return( result ); }
int main( int argc, char * const argv[] ) #endif { character_t media_size_string[ 16 ]; uint8_t guid[ 16 ]; character_t *program = _CHARACTER_T_STRING( "ewfinfo" ); #if !defined( HAVE_GLOB_H ) ewfglob_t *glob = NULL; int32_t glob_count = 0; #endif #if defined( HAVE_STRERROR_R ) || defined( HAVE_STRERROR ) system_character_t *error_string = NULL; #endif char *file_format_string = NULL; system_integer_t option = 0; size64_t media_size = 0; uint32_t bytes_per_sector = 0; uint32_t amount_of_sectors = 0; uint32_t error_granularity = 0; uint32_t amount_of_acquiry_errors = 0; uint32_t amount_of_sessions = 0; int8_t compression_level = 0; int8_t media_type = 0; int8_t media_flags = 0; int8_t volume_type = 0; uint8_t compress_empty_block = 0; uint8_t format = 0; uint8_t verbose = 0; uint8_t date_format = LIBEWF_DATE_FORMAT_CTIME; char info_option = 'a'; int result = 0; /* ewfoutput_version_fprint( stdout, program ); */ while( ( option = ewfgetopt( argc, argv, _SYSTEM_CHARACTER_T_STRING( "d:ehimvcV" ) ) ) != (system_integer_t) -1 ) { switch( option ) { case (system_integer_t) '?': default: fprintf( stderr, "Invalid argument: %" PRIs_SYSTEM "\n", argv[ optind ] ); usage_fprint( stdout ); return( EXIT_FAILURE ); case (system_integer_t) 'd': if( system_string_compare( optarg, _SYSTEM_CHARACTER_T_STRING( "dm" ), 3 ) == 0 ) { date_format = LIBEWF_DATE_FORMAT_DAYMONTH; } else if( system_string_compare( optarg, _SYSTEM_CHARACTER_T_STRING( "md" ), 3 ) == 0 ) { date_format = LIBEWF_DATE_FORMAT_MONTHDAY; } else if( system_string_compare( optarg, _SYSTEM_CHARACTER_T_STRING( "iso8601" ), 8 ) == 0 ) { date_format = LIBEWF_DATE_FORMAT_ISO8601; } else if( system_string_compare( optarg, _SYSTEM_CHARACTER_T_STRING( "ctime" ), 3 ) != 0 ) { fprintf( stderr, "Unsupported date format: %" PRIs_SYSTEM " using default ctime.\n", optarg ); } break; case (system_integer_t) 'e': if( info_option != 'a' ) { fprintf( stderr, "Conflicting options: %" PRIc_SYSTEM " and %c\n", option, info_option ); usage_fprint( stdout ); return( EXIT_FAILURE ); } info_option = 'e'; break; case (system_integer_t) 'h': usage_fprint( stdout ); return( EXIT_SUCCESS ); case (system_integer_t) 'i': if( info_option != 'a' ) { fprintf( stderr, "Conflicting options: %" PRIc_SYSTEM " and %c\n", option, info_option ); usage_fprint( stdout ); return( EXIT_FAILURE ); } info_option = 'i'; break; case (system_integer_t) 'c': info_option = 'c'; break; case (system_integer_t) 'm': if( info_option != 'a' ) { fprintf( stderr, "Conflicting options: %" PRIc_SYSTEM " and %c\n", option, info_option ); usage_fprint( stdout ); return( EXIT_FAILURE ); } info_option = 'm'; break; case (system_integer_t) 'v': verbose = 1; break; case (system_integer_t) 'V': ewfoutput_copyright_fprint( stdout ); return( EXIT_SUCCESS ); } } if( optind == argc ) { fprintf( stderr, "Missing EWF image file(s).\n" ); usage_fprint( stdout ); return( EXIT_FAILURE ); } libewf_set_notify_values( stderr, verbose ); if( ewfsignal_attach( ewfcommon_signal_handler ) != 1 ) { fprintf( stderr, "Unable to attach signal handler.\n" ); } #if 0 && !defined( HAVE_GLOB_H ) glob = ewfglob_alloc(); if( glob == NULL ) { fprintf( stderr, "Unable to create glob.\n" ); return( EXIT_FAILURE ); } glob_count = ewfglob_resolve( glob, &argv[ optind ], ( argc - optind ) ); if( glob_count <= 0 ) { fprintf( stderr, "Unable to resolve glob.\n" ); ewfglob_free( glob ); return( EXIT_FAILURE ); } ewfcommon_libewf_handle = libewf_open( glob->results, glob->amount, LIBEWF_OPEN_READ ); ewfglob_free( glob ); #else ewfcommon_libewf_handle = libewf_open( &argv[ optind ], ( argc - optind ), LIBEWF_OPEN_READ ); #endif if( ( ewfcommon_abort == 0 ) && ( ewfcommon_libewf_handle == NULL ) ) { #if defined( HAVE_STRERROR_R ) || defined( HAVE_STRERROR ) if( errno != 0 ) { error_string = ewfcommon_strerror( errno ); } if( error_string != NULL ) { fprintf( stderr, "Unable to open EWF file(s) with failure: %" PRIs_SYSTEM ".\n", error_string ); memory_free( error_string ); } else { fprintf( stderr, "Unable to open EWF file(s).\n" ); } #else fprintf( stderr, "Unable to open EWF file(s).\n" ); #endif return( EXIT_FAILURE ); } if( ( ewfcommon_abort == 0 ) && ( libewf_parse_header_values( ewfcommon_libewf_handle, date_format ) != 1 ) ) { fprintf( stderr, "Unable to parse header values.\n" ); } if( ( ewfcommon_abort == 0 ) && ( libewf_get_format( ewfcommon_libewf_handle, &format ) != 1 ) ) { fprintf( stderr, "Unable to determine format.\n" ); } else if( verbose == 1 ) { switch( format ) { case LIBEWF_FORMAT_EWF: file_format_string = "original EWF"; break; case LIBEWF_FORMAT_SMART: file_format_string = "SMART"; break; case LIBEWF_FORMAT_FTK: file_format_string = "FTK Imager"; break; case LIBEWF_FORMAT_ENCASE1: file_format_string = "EnCase 1"; break; case LIBEWF_FORMAT_ENCASE2: file_format_string = "EnCase 2"; break; case LIBEWF_FORMAT_ENCASE3: file_format_string = "EnCase 3"; break; case LIBEWF_FORMAT_ENCASE4: file_format_string = "EnCase 4"; break; case LIBEWF_FORMAT_ENCASE5: file_format_string = "EnCase 5"; break; case LIBEWF_FORMAT_ENCASE6: file_format_string = "EnCase 6"; break; case LIBEWF_FORMAT_LINEN5: file_format_string = "linen 5"; break; case LIBEWF_FORMAT_LINEN6: file_format_string = "linen 6"; break; case LIBEWF_FORMAT_EWFX: file_format_string = "extended EWF (libewf)"; break; case LIBEWF_FORMAT_UNKNOWN: default: file_format_string = "unknown"; break; } fprintf( stdout, "File format:\t\t\t%s\n\n", file_format_string ); } if( ( ewfcommon_abort == 0 ) && ( ( info_option == 'a' ) || ( info_option == 'i' ) ) ) { fprintf( stdout, "Acquiry information\n" ); ewfoutput_header_values_fprint( stdout, ewfcommon_libewf_handle ); fprintf( stdout, "\n" ); } if( ( ewfcommon_abort == 0 ) && ( ( info_option == 'a' ) || ( info_option == 'm' ) ) ) { fprintf( stdout, "Media information\n" ); if( ( format != LIBEWF_FORMAT_EWF ) && ( format != LIBEWF_FORMAT_SMART ) ) { if( libewf_get_media_type( ewfcommon_libewf_handle, &media_type ) != 1 ) { fprintf( stderr, "Unable to determine media type.\n" ); } else if( media_type == LIBEWF_MEDIA_TYPE_REMOVABLE ) { fprintf( stdout, "\tMedia type:\t\tremovable disk\n" ); } else if( media_type == LIBEWF_MEDIA_TYPE_FIXED ) { fprintf( stdout, "\tMedia type:\t\tfixed disk\n" ); } else if( media_type == LIBEWF_MEDIA_TYPE_CD ) { fprintf( stdout, "\tMedia type:\t\tCD/DVD\n" ); } else { fprintf( stdout, "\tMedia type:\t\tunknown (0x%" PRIx8 ")\n", media_type ); } if( libewf_get_media_flags( ewfcommon_libewf_handle, &media_flags ) != 1 ) { fprintf( stderr, "Unable to determine media flags.\n" ); } else if( verbose == 1 ) { fprintf( stdout, "\tMedia flags:\t\t0x%" PRIx8 "\n", media_flags ); } if( libewf_get_volume_type( ewfcommon_libewf_handle, &volume_type ) != 1 ) { fprintf( stderr, "Unable to determine volume type.\n" ); } else if( volume_type == LIBEWF_VOLUME_TYPE_LOGICAL ) { fprintf( stdout, "\tMedia is physical:\tno\n" ); } else if( volume_type == LIBEWF_VOLUME_TYPE_PHYSICAL ) { fprintf( stdout, "\tMedia is physical:\tyes\n" ); } else { fprintf( stdout, "\tVolume type:\t\tunknown (0x%" PRIx8 ")\n", volume_type ); } } if( libewf_get_amount_of_sectors( ewfcommon_libewf_handle, &amount_of_sectors ) == 1 ) { fprintf( stdout, "\tAmount of sectors:\t%" PRIu32 "\n", amount_of_sectors ); } else { fprintf( stderr, "Unable to determine amount of sectors.\n" ); } if( libewf_get_bytes_per_sector( ewfcommon_libewf_handle, &bytes_per_sector ) == 1 ) { fprintf( stdout, "\tBytes per sector:\t%" PRIu32 "\n", bytes_per_sector ); } else { fprintf( stderr, "Unable to determine bytes per sector.\n" ); } if( libewf_get_media_size( ewfcommon_libewf_handle, &media_size ) == 1 ) { result = ewfbyte_size_string_create( media_size_string, 16, media_size, EWFBYTE_SIZE_STRING_UNIT_MEBIBYTE ); if( result == 1 ) { fprintf( stdout, "\tMedia size:\t\t%" PRIs " (%" PRIu64 " bytes)\n", media_size_string, media_size ); } else { fprintf( stdout, "\tMedia size:\t\t%" PRIu64 " bytes\n", media_size ); } } else { fprintf( stderr, "Unable to determine media size.\n" ); } if( ( format == LIBEWF_FORMAT_ENCASE5 ) || ( format == LIBEWF_FORMAT_ENCASE6 ) || ( format == LIBEWF_FORMAT_LINEN5 ) || ( format == LIBEWF_FORMAT_LINEN6 ) || ( format == LIBEWF_FORMAT_EWFX ) ) { if( libewf_get_error_granularity( ewfcommon_libewf_handle, &error_granularity ) == 1 ) { fprintf( stdout, "\tError granularity:\t%" PRIu32 "\n", error_granularity ); } else { fprintf( stderr, "Unable to determine error granularity.\n" ); } if( libewf_get_compression_values( ewfcommon_libewf_handle, &compression_level, &compress_empty_block ) == 1 ) { if( compression_level == LIBEWF_COMPRESSION_NONE ) { fprintf( stdout, "\tCompression type:\tno compression\n" ); } else if( compression_level == LIBEWF_COMPRESSION_FAST ) { fprintf( stdout, "\tCompression type:\tgood (fast) compression\n" ); } else if( compression_level == LIBEWF_COMPRESSION_BEST ) { fprintf( stdout, "\tCompression type:\tbest compression\n" ); } else { fprintf( stdout, "\tCompression type:\tunknown compression\n" ); } } else { fprintf( stderr, "Unable to determine compression level.\n" ); } if( libewf_get_guid( ewfcommon_libewf_handle, guid, 16 ) == 1 ) { fprintf( stdout, "\tGUID:\t\t\t%.2" PRIx8 "%.2" PRIx8 "%.2" PRIx8 "%.2" PRIx8 "-%.2" PRIx8 "%.2" PRIx8 "-%.2" PRIx8 "%.2" PRIx8 "-%.2" PRIx8 "%.2" PRIx8 "-%.2" PRIx8 "%.2" PRIx8 "%.2" PRIx8 "%.2" PRIx8 "%.2" PRIx8 "%.2" PRIx8 "\n", guid[ 0 ], guid[ 1 ], guid[ 2 ], guid[ 3 ], guid[ 4 ], guid[ 5 ], guid[ 6 ], guid[ 7 ], guid[ 8 ], guid[ 9 ], guid[ 10 ], guid[ 11 ], guid[ 12 ], guid[ 13 ], guid[ 14 ], guid[ 15 ] ); } } ewfoutput_hash_values_fprint( stdout, ewfcommon_libewf_handle ); fprintf( stdout, "\n" ); ewfoutput_sessions_fprint( stdout, ewfcommon_libewf_handle, &amount_of_sessions ); } if ( ( ewfcommon_abort == 0) && ( ( info_option =='c' ))) { libewf_internal_handle_t *handle = (libewf_internal_handle_t *)ewfcommon_libewf_handle; int i; struct libewf_chunk_offset *chunk = handle->offset_table->chunk_offset; // Print some attributes printf("size=%lld\n", handle->media_values->media_size); printf("chunk_size=%d\n", handle->media_values->chunk_size); printf("count=%d\n", handle->offset_table->amount); for(i=0; i<handle->offset_table->amount; i++) { printf("%d,%lld,%d,%d,%s\n", i, chunk[i].file_offset, chunk[i].size, chunk[i].compressed, chunk[i].segment_file_handle->filename); }; }; if( ( ewfcommon_abort == 0 ) && ( ( info_option == 'a' ) || ( info_option == 'e' ) ) ) { ewfoutput_acquiry_errors_fprint( stdout, ewfcommon_libewf_handle, &amount_of_acquiry_errors ); } if( ewfsignal_detach() != 1 ) { fprintf( stderr, "Unable to detach signal handler.\n" ); } if( ewfcommon_abort != 0 ) { fprintf( stdout, "%" PRIs ": ABORTED\n", program ); return( EXIT_FAILURE ); } if( libewf_close( ewfcommon_libewf_handle ) != 0 ) { fprintf( stderr, "Unable to close EWF file(s).\n" ); return( EXIT_FAILURE ); } return( EXIT_SUCCESS ); }
int main( int argc, char * const argv[] ) #endif { libcerror_error_t *error = NULL; system_character_t *option_file_entry = NULL; system_character_t *option_mft_entry_index = NULL; system_character_t *option_volume_offset = NULL; system_character_t *source = NULL; char *program = "fsntfsinfo"; system_integer_t option = 0; size_t string_length = 0; uint64_t mft_entry_index = 0; int option_mode = FSNTFSINFO_MODE_VOLUME; int verbose = 0; libcnotify_stream_set( stderr, NULL ); libcnotify_verbose_set( 1 ); if( libclocale_initialize( "fsntfstools", &error ) != 1 ) { fprintf( stderr, "Unable to initialize locale values.\n" ); goto on_error; } if( fsntfstools_output_initialize( _IONBF, &error ) != 1 ) { fprintf( stderr, "Unable to initialize output settings.\n" ); goto on_error; } fsntfstools_output_version_fprint( stdout, program ); while( ( option = fsntfstools_getopt( argc, argv, _SYSTEM_STRING( "E:F:hHo:UvV" ) ) ) != (system_integer_t) -1 ) { switch( option ) { case (system_integer_t) '?': default: fprintf( stderr, "Invalid argument: %" PRIs_SYSTEM "\n", argv[ optind - 1 ] ); usage_fprint( stdout ); return( EXIT_FAILURE ); case (system_integer_t) 'E': option_mode = FSNTFSINFO_MODE_MFT_ENTRY; option_mft_entry_index = optarg; break; case (system_integer_t) 'F': option_mode = FSNTFSINFO_MODE_FILE_ENTRY; option_file_entry = optarg; break; case (system_integer_t) 'h': usage_fprint( stdout ); return( EXIT_SUCCESS ); case (system_integer_t) 'H': option_mode = FSNTFSINFO_MODE_FILE_SYSTEM_HIERARCHY; break; case (system_integer_t) 'o': option_volume_offset = optarg; break; case (system_integer_t) 'U': option_mode = FSNTFSINFO_MODE_USN_CHANGE_JOURNAL; break; case (system_integer_t) 'v': verbose = 1; break; case (system_integer_t) 'V': fsntfstools_output_copyright_fprint( stdout ); return( EXIT_SUCCESS ); } } if( optind == argc ) { fprintf( stderr, "Missing source file or device.\n" ); usage_fprint( stdout ); return( EXIT_FAILURE ); } source = argv[ optind ]; libcnotify_verbose_set( verbose ); libfsntfs_notify_set_stream( stderr, NULL ); libfsntfs_notify_set_verbose( verbose ); if( info_handle_initialize( &fsntfsinfo_info_handle, &error ) != 1 ) { fprintf( stderr, "Unable to initialize info handle.\n" ); goto on_error; } if( option_volume_offset != NULL ) { if( info_handle_set_volume_offset( fsntfsinfo_info_handle, option_volume_offset, &error ) != 1 ) { libcnotify_print_error_backtrace( error ); libcerror_error_free( &error ); fprintf( stderr, "Unsupported volume offset defaulting to: %" PRIi64 ".\n", fsntfsinfo_info_handle->volume_offset ); } } if( info_handle_open_input( fsntfsinfo_info_handle, source, &error ) != 1 ) { fprintf( stderr, "Unable to open: %" PRIs_SYSTEM ".\n", source ); goto on_error; } switch( option_mode ) { case FSNTFSINFO_MODE_FILE_ENTRY: if( fsntfsinfo_info_handle->input_volume == NULL ) { fprintf( stderr, "Unable to print file entry information.\n" ); goto on_error; } if( info_handle_file_entry_fprint( fsntfsinfo_info_handle, option_file_entry, &error ) != 1 ) { fprintf( stderr, "Unable to print file entry information.\n" ); goto on_error; } break; case FSNTFSINFO_MODE_FILE_SYSTEM_HIERARCHY: if( info_handle_file_system_hierarchy_fprint( fsntfsinfo_info_handle, &error ) != 1 ) { fprintf( stderr, "Unable to print file system hierarchy.\n" ); goto on_error; } break; case FSNTFSINFO_MODE_MFT_ENTRY: if( option_mft_entry_index == NULL ) { fprintf( stderr, "Mising MFT entry index string.\n" ); goto on_error; } string_length = system_string_length( option_mft_entry_index ); if( ( string_length == 3 ) && ( system_string_compare( option_mft_entry_index, _SYSTEM_STRING( "all" ), 3 ) == 0 ) ) { if( info_handle_mft_entries_fprint( fsntfsinfo_info_handle, &error ) != 1 ) { fprintf( stderr, "Unable to print MFT entries.\n" ); goto on_error; } } else if( fsntfstools_system_string_copy_from_64_bit_in_decimal( option_mft_entry_index, string_length + 1, &mft_entry_index, &error ) == 1 ) { if( mft_entry_index > (uint64_t) INT64_MAX ) { fprintf( stderr, "Invalid MFT entry index value out of bounds." ); goto on_error; } if( info_handle_mft_entry_fprint( fsntfsinfo_info_handle, mft_entry_index, &error ) != 1 ) { fprintf( stderr, "Unable to print MFT entry: %" PRIu64 ".\n", mft_entry_index ); goto on_error; } } else { fprintf( stderr, "Unable to copy MFT entry index string to 64-bit decimal.\n" ); goto on_error; } break; case FSNTFSINFO_MODE_USN_CHANGE_JOURNAL: if( fsntfsinfo_info_handle->input_volume == NULL ) { fprintf( stderr, "Unable to print USN change journal ($UsnJrnl) information.\n" ); goto on_error; } if( info_handle_usn_change_journal_fprint( fsntfsinfo_info_handle, &error ) != 1 ) { fprintf( stderr, "Unable to print USN change journal ($UsnJrnl) information.\n" ); goto on_error; } break; case FSNTFSINFO_MODE_VOLUME: default: if( info_handle_volume_fprint( fsntfsinfo_info_handle, &error ) != 1 ) { fprintf( stderr, "Unable to print volume information.\n" ); goto on_error; } break; } if( info_handle_close_input( fsntfsinfo_info_handle, &error ) != 0 ) { fprintf( stderr, "Unable to close info handle.\n" ); goto on_error; } if( info_handle_free( &fsntfsinfo_info_handle, &error ) != 1 ) { fprintf( stderr, "Unable to free info handle.\n" ); goto on_error; } return( EXIT_SUCCESS ); on_error: if( error != NULL ) { libcnotify_print_error_backtrace( error ); libcerror_error_free( &error ); } if( fsntfsinfo_info_handle != NULL ) { info_handle_free( &fsntfsinfo_info_handle, NULL ); } return( EXIT_FAILURE ); }