/* Sets the format
* Returns 1 if successful, 0 if unsupported value or -1 on error
*/
int mount_handle_set_format(
mount_handle_t *mount_handle,
const libcstring_system_character_t *string,
libcerror_error_t **error )
{
static char *function = "mount_handle_set_format";
size_t string_length = 0;
int result = 0;
if( mount_handle == NULL )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
"%s: invalid mount handle.",
function );
return( -1 );
}
string_length = libcstring_system_string_length(
string );
if( string_length == 3 )
{
if( libcstring_system_string_compare(
string,
_LIBCSTRING_SYSTEM_STRING( "raw" ),
3 ) == 0 )
{
mount_handle->input_format = MOUNT_HANDLE_INPUT_FORMAT_RAW;
result = 1;
}
}
else if( string_length == 5 )
{
if( libcstring_system_string_compare(
string,
_LIBCSTRING_SYSTEM_STRING( "files" ),
5 ) == 0 )
{
mount_handle->input_format = MOUNT_HANDLE_INPUT_FORMAT_FILES;
result = 1;
}
}
return( result );
}
/* Exports the values in a Container_ table record
* Returns 1 if successful or -1 on error
*/
int webcache_export_record_container(
libesedb_record_t *record,
FILE *record_file_stream,
log_handle_t *log_handle,
libcerror_error_t **error )
{
libcstring_system_character_t column_name[ 256 ];
static char *function = "webcache_export_record_container";
size_t column_name_size = 0;
uint32_t column_type = 0;
int known_column_type = 0;
int number_of_values = 0;
int result = 0;
int value_iterator = 0;
uint8_t byte_order = _BYTE_STREAM_ENDIAN_LITTLE;
if( record == NULL )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
"%s: invalid record.",
function );
return( -1 );
}
if( record_file_stream == NULL )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
"%s: invalid record file stream.",
function );
return( -1 );
}
if( libesedb_record_get_number_of_values(
record,
&number_of_values,
error ) != 1 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_GET_FAILED,
"%s: unable to retrieve number of values.",
function );
return( -1 );
}
for( value_iterator = 0;
value_iterator < number_of_values;
value_iterator++ )
{
#if defined( LIBCSTRING_HAVE_WIDE_SYSTEM_CHARACTER )
result = libesedb_record_get_utf16_column_name_size(
record,
value_iterator,
&column_name_size,
error );
#else
result = libesedb_record_get_utf8_column_name_size(
record,
value_iterator,
&column_name_size,
error );
#endif
if( result != 1 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_GET_FAILED,
"%s: unable to retrieve column name size of value: %d.",
function,
value_iterator );
return( -1 );
}
/* It is assumed that the column name cannot be larger than 255 characters
* otherwise using dynamic allocation is more appropriate
*/
if( column_name_size > 256 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
"%s: column name size value exceeds maximum.",
function );
return( -1 );
}
#if defined( LIBCSTRING_HAVE_WIDE_SYSTEM_CHARACTER )
result = libesedb_record_get_utf16_column_name(
record,
value_iterator,
(uint16_t *) column_name,
column_name_size,
error );
#else
result = libesedb_record_get_utf8_column_name(
record,
value_iterator,
(uint8_t *) column_name,
column_name_size,
error );
#endif
if( result != 1 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_GET_FAILED,
"%s: unable to retrieve column name of value: %d.",
function,
value_iterator );
return( -1 );
}
if( libesedb_record_get_column_type(
record,
value_iterator,
&column_type,
error ) != 1 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_GET_FAILED,
"%s: unable to retrieve column type of value: %d.",
function,
value_iterator );
return( -1 );
}
known_column_type = WEBCACHE_KNOWN_COLUMN_TYPE_UNDEFINED;
if( column_type == LIBESEDB_COLUMN_TYPE_INTEGER_64BIT_SIGNED )
{
if( column_name_size == 9 )
{
if( libcstring_system_string_compare(
column_name,
_LIBCSTRING_SYSTEM_STRING( "SyncTime" ),
8 ) == 0 )
{
known_column_type = WEBCACHE_KNOWN_COLUMN_TYPE_FILETIME;
}
}
else if( column_name_size == 11 )
{
if( libcstring_system_string_compare(
column_name,
_LIBCSTRING_SYSTEM_STRING( "ExpiryTime" ),
10 ) == 0 )
{
known_column_type = WEBCACHE_KNOWN_COLUMN_TYPE_FILETIME;
}
}
else if( column_name_size == 13 )
{
if( libcstring_system_string_compare(
column_name,
_LIBCSTRING_SYSTEM_STRING( "AccessedTime" ),
12 ) == 0 )
{
known_column_type = WEBCACHE_KNOWN_COLUMN_TYPE_FILETIME;
}
else if( libcstring_system_string_compare(
column_name,
_LIBCSTRING_SYSTEM_STRING( "CreationTime" ),
12 ) == 0 )
{
known_column_type = WEBCACHE_KNOWN_COLUMN_TYPE_FILETIME;
}
else if( libcstring_system_string_compare(
column_name,
_LIBCSTRING_SYSTEM_STRING( "ModifiedTime" ),
12 ) == 0 )
{
known_column_type = WEBCACHE_KNOWN_COLUMN_TYPE_FILETIME;
}
}
}
if( known_column_type == WEBCACHE_KNOWN_COLUMN_TYPE_FILETIME )
{
result = export_filetime(
record,
value_iterator,
byte_order,
record_file_stream,
error );
}
else if( known_column_type == WEBCACHE_KNOWN_COLUMN_TYPE_UNDEFINED )
{
result = export_handle_export_record_value(
record,
value_iterator,
record_file_stream,
log_handle,
error );
}
if( result != 1 )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_RUNTIME,
LIBCERROR_RUNTIME_ERROR_GENERIC,
"%s: unable to export record value: %d.",
function,
value_iterator );
return( -1 );
}
if( value_iterator == ( number_of_values - 1 ) )
{
fprintf(
record_file_stream,
"\n" );
}
else
{
fprintf(
record_file_stream,
"\t" );
}
}
return( 1 );
}
/* Determines the export format from a string
* Returns 1 if successful, 0 if unsupported value or -1 on error
*/
int pffinput_determine_export_format(
const libcstring_system_character_t *string,
int *export_format,
libcerror_error_t **error )
{
static char *function = "pffinput_determine_export_format";
size_t string_length = 0;
int result = 0;
if( string == NULL )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
"%s: invalid string string.",
function );
return( -1 );
}
if( export_format == NULL )
{
libcerror_error_set(
error,
LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
"%s: invalid export format.",
function );
return( -1 );
}
string_length = libcstring_system_string_length(
string );
if( string_length == 3 )
{
if( libcstring_system_string_compare(
string,
_LIBCSTRING_SYSTEM_STRING( "all" ),
3 ) == 0 )
{
*export_format = EXPORT_FORMAT_ALL;
result = 1;
}
else if( libcstring_system_string_compare(
string,
_LIBCSTRING_SYSTEM_STRING( "ftk" ),
3 ) == 0 )
{
*export_format = EXPORT_FORMAT_FTK;
result = 1;
}
else if( libcstring_system_string_compare(
string,
_LIBCSTRING_SYSTEM_STRING( "htm" ),
3 ) == 0 )
{
*export_format = EXPORT_FORMAT_HTML;
result = 1;
}
else if( libcstring_system_string_compare(
string,
_LIBCSTRING_SYSTEM_STRING( "rtf" ),
3 ) == 0 )
{
*export_format = EXPORT_FORMAT_RTF;
result = 1;
}
else if( libcstring_system_string_compare(
string,
_LIBCSTRING_SYSTEM_STRING( "txt" ),
3 ) == 0 )
{
*export_format = EXPORT_FORMAT_TEXT;
result = 1;
}
}
else if( string_length == 4 )
{
if( libcstring_system_string_compare(
string,
_LIBCSTRING_SYSTEM_STRING( "html" ),
4 ) == 0 )
{
*export_format = EXPORT_FORMAT_HTML;
result = 1;
}
else if( libcstring_system_string_compare(
string,
_LIBCSTRING_SYSTEM_STRING( "text" ),
4 ) == 0 )
{
*export_format = EXPORT_FORMAT_TEXT;
result = 1;
}
}
return( result );
}
int main( int argc, char * const argv[] )
#endif
{
libcerror_error_t *error = NULL;
libcstring_system_character_t *log_filename = NULL;
libcstring_system_character_t *option_additional_digest_types = NULL;
libcstring_system_character_t *option_bytes_per_sector = NULL;
libcstring_system_character_t *option_case_number = NULL;
libcstring_system_character_t *option_compression_values = NULL;
libcstring_system_character_t *option_description = NULL;
libcstring_system_character_t *option_examiner_name = NULL;
libcstring_system_character_t *option_evidence_number = NULL;
libcstring_system_character_t *option_format = NULL;
libcstring_system_character_t *option_header_codepage = NULL;
libcstring_system_character_t *option_maximum_segment_size = NULL;
libcstring_system_character_t *option_media_flags = NULL;
libcstring_system_character_t *option_media_type = NULL;
libcstring_system_character_t *option_notes = NULL;
libcstring_system_character_t *option_offset = NULL;
libcstring_system_character_t *option_process_buffer_size = NULL;
libcstring_system_character_t *option_secondary_target_filename = NULL;
libcstring_system_character_t *option_sectors_per_chunk = NULL;
libcstring_system_character_t *option_size = NULL;
libcstring_system_character_t *option_target_filename = NULL;
libcstring_system_character_t *program = _LIBCSTRING_SYSTEM_STRING( "ewfacquirestream" );
log_handle_t *log_handle = NULL;
libcstring_system_integer_t option = 0;
size_t string_length = 0;
uint8_t calculate_md5 = 1;
uint8_t print_status_information = 1;
uint8_t read_error_retries = 2;
uint8_t resume_acquiry = 0;
uint8_t swap_byte_pairs = 0;
uint8_t use_chunk_data_functions = 0;
uint8_t verbose = 0;
int result = 0;
libcnotify_stream_set(
stderr,
NULL );
libcnotify_verbose_set(
1 );
if( libclocale_initialize(
"ewftools",
&error ) != 1 )
{
fprintf(
stderr,
"Unable to initialize locale values.\n" );
goto on_error;
}
if( libcsystem_initialize(
_IONBF,
&error ) != 1 )
{
ewfoutput_version_fprint(
stdout,
program );
fprintf(
stderr,
"Unable to initialize system values.\n" );
goto on_error;
}
#if defined( WINAPI ) && !defined( __CYGWIN__ )
#if defined( _MSC_VER )
if( _setmode(
_fileno(
stdin ),
_O_BINARY ) == -1 )
#else
if( setmode(
_fileno(
stdin ),
_O_BINARY ) == -1 )
#endif
{
ewfoutput_version_fprint(
stdout,
program );
fprintf(
stderr,
"Unable to set stdin to binary mode.\n" );
usage_fprint(
stdout );
goto on_error;
}
#endif
while( ( option = libcsystem_getopt(
argc,
argv,
_LIBCSTRING_SYSTEM_STRING( "A:b:B:c:C:d:D:e:E:f:hl:m:M:N:o:p:P:qsS:t:vVx2:" ) ) ) != (libcstring_system_integer_t) -1 )
{
switch( option )
{
case (libcstring_system_integer_t) '?':
default:
ewfoutput_version_fprint(
stdout,
program );
fprintf(
stderr,
"Invalid argument: %" PRIs_LIBCSTRING_SYSTEM "\n",
argv[ optind - 1 ] );
usage_fprint(
stdout );
goto on_error;
case (libcstring_system_integer_t) 'A':
option_header_codepage = optarg;
break;
case (libcstring_system_integer_t) 'b':
option_sectors_per_chunk = optarg;
break;
case (libcstring_system_integer_t) 'B':
option_size = optarg;
break;
case (libcstring_system_integer_t) 'c':
option_compression_values = optarg;
break;
case (libcstring_system_integer_t) 'C':
option_case_number = optarg;
break;
case (libcstring_system_integer_t) 'd':
option_additional_digest_types = optarg;
break;
case (libcstring_system_integer_t) 'D':
option_description = optarg;
break;
case (libcstring_system_integer_t) 'e':
option_examiner_name = optarg;
break;
case (libcstring_system_integer_t) 'E':
option_evidence_number = optarg;
break;
case (libcstring_system_integer_t) 'f':
option_format = optarg;
break;
case (libcstring_system_integer_t) 'h':
ewfoutput_version_fprint(
stdout,
program );
usage_fprint(
stdout );
return( EXIT_SUCCESS );
case (libcstring_system_integer_t) 'l':
log_filename = optarg;
break;
case (libcstring_system_integer_t) 'm':
option_media_type = optarg;
break;
case (libcstring_system_integer_t) 'M':
option_media_flags = optarg;
break;
case (libcstring_system_integer_t) 'N':
option_notes = optarg;
break;
case (libcstring_system_integer_t) 'o':
option_offset = optarg;
break;
case (libcstring_system_integer_t) 'p':
option_process_buffer_size = optarg;
break;
case (libcstring_system_integer_t) 'P':
option_bytes_per_sector = optarg;
break;
case (libcstring_system_integer_t) 'q':
print_status_information = 0;
break;
case (libcstring_system_integer_t) 's':
swap_byte_pairs = 1;
break;
case (libcstring_system_integer_t) 'S':
option_maximum_segment_size = optarg;
break;
case (libcstring_system_integer_t) 't':
option_target_filename = optarg;
break;
case (libcstring_system_integer_t) 'v':
verbose = 1;
break;
case (libcstring_system_integer_t) 'V':
ewfoutput_version_fprint(
stdout,
program );
ewfoutput_copyright_fprint(
stdout );
return( EXIT_SUCCESS );
case (libcstring_system_integer_t) 'x':
use_chunk_data_functions = 1;
break;
case (libcstring_system_integer_t) '2':
option_secondary_target_filename = optarg;
break;
}
}
ewfoutput_version_fprint(
stdout,
program );
libcnotify_verbose_set(
verbose );
#if !defined( HAVE_LOCAL_LIBEWF )
libewf_notify_set_verbose(
verbose );
libewf_notify_set_stream(
stderr,
NULL );
#endif
if( ( option_target_filename != NULL )
&& ( option_secondary_target_filename != NULL ) )
{
string_length = libcstring_system_string_length(
option_secondary_target_filename );
if( libcstring_system_string_length(
option_target_filename ) == string_length )
{
if( libcstring_system_string_compare(
option_target_filename,
option_secondary_target_filename,
string_length ) == 0 )
{
fprintf(
stderr,
"Primary and secondary target cannot be the same.\n" );
goto on_error;
}
}
}
if( imaging_handle_initialize(
&ewfacquirestream_imaging_handle,
calculate_md5,
use_chunk_data_functions,
&error ) != 1 )
{
fprintf(
stderr,
"Unable to create imaging handle.\n" );
goto on_error;
}
if( option_header_codepage != NULL )
{
result = imaging_handle_set_header_codepage(
ewfacquirestream_imaging_handle,
option_header_codepage,
&error );
if( result == -1 )
{
fprintf(
stderr,
"Unable to set header codepage.\n" );
goto on_error;
}
else if( result == 0 )
{
fprintf(
stderr,
"Unsupported header codepage defaulting to: ascii.\n" );
}
}
if( option_target_filename != NULL )
{
if( imaging_handle_set_string(
ewfacquirestream_imaging_handle,
option_target_filename,
&( ewfacquirestream_imaging_handle->target_filename ),
&( ewfacquirestream_imaging_handle->target_filename_size ),
&error ) != 1 )
{
fprintf(
stderr,
"Unable to set target filename.\n" );
goto on_error;
}
}
else
{
/* Make sure the target filename is set
*/
if( imaging_handle_set_string(
ewfacquirestream_imaging_handle,
_LIBCSTRING_SYSTEM_STRING( "image" ),
&( ewfacquirestream_imaging_handle->target_filename ),
&( ewfacquirestream_imaging_handle->target_filename_size ),
&error ) != 1 )
{
fprintf(
stderr,
"Unable to set target filename.\n" );
goto on_error;
}
}
if( option_secondary_target_filename != NULL )
{
if( imaging_handle_set_string(
ewfacquirestream_imaging_handle,
option_secondary_target_filename,
&( ewfacquirestream_imaging_handle->secondary_target_filename ),
&( ewfacquirestream_imaging_handle->secondary_target_filename_size ),
&error ) != 1 )
{
fprintf(
stderr,
"Unable to set secondary target filename.\n" );
goto on_error;
}
}
if( option_case_number == NULL )
{
option_case_number = _LIBCSTRING_SYSTEM_STRING( "case_number" );
}
if( imaging_handle_set_string(
ewfacquirestream_imaging_handle,
option_case_number,
&( ewfacquirestream_imaging_handle->case_number ),
&( ewfacquirestream_imaging_handle->case_number_size ),
&error ) != 1 )
{
fprintf(
stderr,
"Unable to set case number.\n" );
goto on_error;
}
if( option_description == NULL )
{
option_description = _LIBCSTRING_SYSTEM_STRING( "description" );
}
if( imaging_handle_set_string(
ewfacquirestream_imaging_handle,
option_description,
&( ewfacquirestream_imaging_handle->description ),
&( ewfacquirestream_imaging_handle->description_size ),
&error ) != 1 )
{
fprintf(
stderr,
"Unable to set description.\n" );
goto on_error;
}
if( option_evidence_number == NULL )
{
option_evidence_number = _LIBCSTRING_SYSTEM_STRING( "evidence_number" );
}
if( imaging_handle_set_string(
ewfacquirestream_imaging_handle,
option_evidence_number,
&( ewfacquirestream_imaging_handle->evidence_number ),
&( ewfacquirestream_imaging_handle->evidence_number_size ),
&error ) != 1 )
{
fprintf(
stderr,
"Unable to set evidence number.\n" );
goto on_error;
}
if( option_examiner_name == NULL )
{
option_examiner_name = _LIBCSTRING_SYSTEM_STRING( "examiner_name" );
}
if( imaging_handle_set_string(
ewfacquirestream_imaging_handle,
option_examiner_name,
&( ewfacquirestream_imaging_handle->examiner_name ),
&( ewfacquirestream_imaging_handle->examiner_name_size ),
&error ) != 1 )
{
fprintf(
stderr,
"Unable to set examiner name.\n" );
goto on_error;
}
if( option_notes == NULL )
{
option_notes = _LIBCSTRING_SYSTEM_STRING( "notes" );
}
if( imaging_handle_set_string(
ewfacquirestream_imaging_handle,
option_notes,
&( ewfacquirestream_imaging_handle->notes ),
&( ewfacquirestream_imaging_handle->notes_size ),
&error ) != 1 )
{
fprintf(
stderr,
"Unable to set notes.\n" );
goto on_error;
}
if( option_format != NULL )
{
result = imaging_handle_set_format(
ewfacquirestream_imaging_handle,
option_format,
&error );
if( result == -1 )
{
fprintf(
stderr,
"Unable to set format.\n" );
goto on_error;
}
else if( ( result == 0 )
|| ( ewfacquirestream_imaging_handle->ewf_format == LIBEWF_FORMAT_EWF )
|| ( ewfacquirestream_imaging_handle->ewf_format == LIBEWF_FORMAT_ENCASE1 )
|| ( ewfacquirestream_imaging_handle->ewf_format == LIBEWF_FORMAT_SMART ) )
{
ewfacquirestream_imaging_handle->ewf_format = LIBEWF_FORMAT_ENCASE6;
fprintf(
stderr,
"Unsupported EWF format defaulting to: encase6.\n" );
}
}
if( option_compression_values != NULL )
{
result = imaging_handle_set_compression_values(
ewfacquirestream_imaging_handle,
option_compression_values,
&error );
if( result == -1 )
{
fprintf(
stderr,
"Unable to set compression values.\n" );
goto on_error;
}
else if( result == 0 )
{
fprintf(
stderr,
"Unsupported compression values defaulting to method: deflate with level: none.\n" );
}
}
if( option_media_type != NULL )
{
result = imaging_handle_set_media_type(
ewfacquirestream_imaging_handle,
option_media_type,
&error );
if( result == -1 )
{
fprintf(
stderr,
"Unable to set media type.\n" );
goto on_error;
}
else if( result == 0 )
{
fprintf(
stderr,
"Unsupported media type defaulting to: fixed.\n" );
}
}
if( option_media_flags != NULL )
{
result = imaging_handle_set_media_flags(
ewfacquirestream_imaging_handle,
option_media_flags,
&error );
if( result == -1 )
{
fprintf(
stderr,
"Unable to set media flags.\n" );
goto on_error;
}
else if( result == 0 )
{
fprintf(
stderr,
"Unsupported media flags defaulting to: physical.\n" );
}
}
if( option_bytes_per_sector != NULL )
{
result = imaging_handle_set_bytes_per_sector(
ewfacquirestream_imaging_handle,
option_bytes_per_sector,
&error );
if( result == -1 )
{
fprintf(
stderr,
"Unable to set bytes per sector.\n" );
goto on_error;
}
else if( result == 0 )
{
fprintf(
stderr,
"Unsupported bytes per sector defaulting to: %" PRIu32 ".\n",
ewfacquirestream_imaging_handle->bytes_per_sector );
}
}
if( option_sectors_per_chunk != NULL )
{
result = imaging_handle_set_sectors_per_chunk(
ewfacquirestream_imaging_handle,
option_sectors_per_chunk,
&error );
if( result == -1 )
{
fprintf(
stderr,
"Unable to set sectors per chunk.\n" );
goto on_error;
}
else if( result == 0 )
{
fprintf(
stderr,
"Unsupported sectors per chunk defaulting to: %" PRIu32 ".\n",
ewfacquirestream_imaging_handle->sectors_per_chunk );
}
}
if( option_maximum_segment_size != NULL )
{
result = imaging_handle_set_maximum_segment_size(
ewfacquirestream_imaging_handle,
option_maximum_segment_size,
&error );
if( result == -1 )
{
fprintf(
stderr,
"Unable to set maximum segment size.\n" );
goto on_error;
}
else if( result == 0 )
{
ewfacquirestream_imaging_handle->maximum_segment_size = EWFCOMMON_DEFAULT_SEGMENT_FILE_SIZE;
fprintf(
stderr,
"Unsupported maximum segment size defaulting to: %" PRIu64 ".\n",
ewfacquirestream_imaging_handle->maximum_segment_size );
}
}
if( option_offset != NULL )
{
result = imaging_handle_set_acquiry_offset(
ewfacquirestream_imaging_handle,
option_offset,
&error );
if( result == -1 )
{
fprintf(
stderr,
"Unable to set acquiry offset.\n" );
goto on_error;
}
else if( result == 0 )
{
ewfacquirestream_imaging_handle->acquiry_offset = 0;
fprintf(
stderr,
"Unsupported acquiry offset defaulting to: 0.\n" );
}
}
if( option_size != NULL )
{
result = imaging_handle_set_acquiry_size(
ewfacquirestream_imaging_handle,
option_size,
&error );
if( result == -1 )
{
fprintf(
stderr,
"Unable to set acquiry size.\n" );
goto on_error;
}
else if( result == 0 )
{
ewfacquirestream_imaging_handle->acquiry_size = 0;
fprintf(
stderr,
"Unsupported acquiry size defaulting to: all bytes.\n" );
}
}
if( option_process_buffer_size != NULL )
{
result = imaging_handle_set_process_buffer_size(
ewfacquirestream_imaging_handle,
option_process_buffer_size,
&error );
if( result == -1 )
{
fprintf(
stderr,
"Unable to set process buffer size.\n" );
goto on_error;
}
else if( result == 0 )
{
fprintf(
stderr,
"Unsupported process buffer size defaulting to: chunk size.\n" );
}
}
if( option_additional_digest_types != NULL )
{
result = imaging_handle_set_additional_digest_types(
ewfacquirestream_imaging_handle,
option_additional_digest_types,
&error );
if( result == -1 )
{
fprintf(
stderr,
"Unable to set additional digest types.\n" );
goto on_error;
}
}
fprintf(
stdout,
"Using the following acquiry parameters:\n" );
if( imaging_handle_print_parameters(
ewfacquirestream_imaging_handle,
0,
read_error_retries,
0,
0,
&error ) != 1 )
{
fprintf(
stderr,
"Unable to print acquiry parameters.\n" );
goto on_error;
}
if( imaging_handle_open_output(
ewfacquirestream_imaging_handle,
ewfacquirestream_imaging_handle->target_filename,
resume_acquiry,
&error ) != 1 )
{
fprintf(
stderr,
"Unable to open output.\n" );
goto on_error;
}
if( ewfacquirestream_imaging_handle->secondary_target_filename != NULL )
{
if( imaging_handle_open_secondary_output(
ewfacquirestream_imaging_handle,
ewfacquirestream_imaging_handle->secondary_target_filename,
resume_acquiry,
&error ) != 1 )
{
fprintf(
stderr,
"Unable to open secondary output.\n" );
goto on_error;
}
}
if( imaging_handle_set_output_values(
ewfacquirestream_imaging_handle,
program,
_LIBCSTRING_SYSTEM_STRING( LIBEWF_VERSION_STRING ),
NULL,
NULL,
&error ) != 1 )
{
fprintf(
stderr,
"Unable to initialize output settings.\n" );
goto on_error;
}
if( libcsystem_signal_attach(
ewfacquirestream_signal_handler,
&error ) != 1 )
{
fprintf(
stderr,
"Unable to attach signal handler.\n" );
libcnotify_print_error_backtrace(
error );
libcerror_error_free(
&error );
}
if( log_filename != NULL )
{
if( log_handle_initialize(
&log_handle,
&error ) != 1 )
{
fprintf(
stderr,
"Unable to create log handle.\n" );
goto on_error;
}
if( log_handle_open(
log_handle,
log_filename,
&error ) != 1 )
{
fprintf(
stderr,
"Unable to open log file: %" PRIs_LIBCSTRING_SYSTEM ".\n",
log_filename );
goto on_error;
}
}
result = ewfacquirestream_read_input(
ewfacquirestream_imaging_handle,
0,
swap_byte_pairs,
read_error_retries,
print_status_information,
use_chunk_data_functions,
log_handle,
&error );
if( result != 1 )
{
fprintf(
stderr,
"Unable to read input.\n" );
libcnotify_print_error_backtrace(
error );
libcerror_error_free(
&error );
}
if( log_handle != NULL )
{
if( log_handle_close(
log_handle,
&error ) != 0 )
{
fprintf(
stderr,
"Unable to close log handle.\n" );
goto on_error;
}
if( log_handle_free(
&log_handle,
&error ) != 1 )
{
fprintf(
stderr,
"Unable to free log handle.\n" );
goto on_error;
}
}
if( libcsystem_signal_detach(
&error ) != 1 )
{
fprintf(
stderr,
"Unable to detach signal handler.\n" );
libcnotify_print_error_backtrace(
error );
libcerror_error_free(
&error );
}
if( imaging_handle_close(
ewfacquirestream_imaging_handle,
&error ) != 0 )
{
fprintf(
stderr,
"Unable to close output.\n" );
goto on_error;
}
if( imaging_handle_free(
&ewfacquirestream_imaging_handle,
&error ) != 1 )
{
fprintf(
stderr,
"Unable to free imaging handle.\n" );
goto on_error;
}
if( ewfacquirestream_abort != 0 )
{
fprintf(
stdout,
"%" PRIs_LIBCSTRING_SYSTEM ": ABORTED\n",
program );
return( EXIT_FAILURE );
}
if( result != 1 )
{
fprintf(
stdout,
"%" PRIs_LIBCSTRING_SYSTEM ": FAILURE\n",
program );
return( EXIT_FAILURE );
}
fprintf(
stdout,
"%" PRIs_LIBCSTRING_SYSTEM ": SUCCESS\n",
program );
return( EXIT_SUCCESS );
on_error:
if( error != NULL )
{
libcnotify_print_error_backtrace(
error );
libcerror_error_free(
&error );
}
if( log_handle != NULL )
{
log_handle_close(
log_handle,
NULL );
log_handle_free(
&log_handle,
NULL );
}
if( ewfacquirestream_imaging_handle != NULL )
{
imaging_handle_close(
ewfacquirestream_imaging_handle,
NULL );
imaging_handle_free(
&ewfacquirestream_imaging_handle,
NULL );
}
return( EXIT_FAILURE );
}
int main( int argc, char * const argv[] )
#endif
{
libfsntfs_error_t *error = NULL;
libcstring_system_character_t *option_mft_entry_index = NULL;
libcstring_system_character_t *option_volume_offset = NULL;
libcstring_system_character_t *source = NULL;
char *program = "fsntfsinfo";
libcstring_system_integer_t option = 0;
size_t string_length = 0;
uint64_t mft_entry_index = 0;
int option_mode = FSNTFSINFO_MODE_VOLUME;
int verbose = 0;
libcnotify_stream_set(
stderr,
NULL );
libcnotify_verbose_set(
1 );
if( libclocale_initialize(
"fsntfstools",
&error ) != 1 )
{
fprintf(
stderr,
"Unable to initialize locale values.\n" );
goto on_error;
}
if( libcsystem_initialize(
_IONBF,
&error ) != 1 )
{
fprintf(
stderr,
"Unable to initialize system values.\n" );
goto on_error;
}
fsntfsoutput_version_fprint(
stdout,
program );
while( ( option = libcsystem_getopt(
argc,
argv,
_LIBCSTRING_SYSTEM_STRING( "E:hHo:UvV" ) ) ) != (libcstring_system_integer_t) -1 )
{
switch( option )
{
case (libcstring_system_integer_t) '?':
default:
fprintf(
stderr,
"Invalid argument: %" PRIs_LIBCSTRING_SYSTEM "\n",
argv[ optind - 1 ] );
usage_fprint(
stdout );
return( EXIT_FAILURE );
case (libcstring_system_integer_t) 'E':
option_mode = FSNTFSINFO_MODE_MFT_ENTRY;
option_mft_entry_index = optarg;
break;
case (libcstring_system_integer_t) 'h':
usage_fprint(
stdout );
return( EXIT_SUCCESS );
case (libcstring_system_integer_t) 'H':
option_mode = FSNTFSINFO_MODE_FILE_SYSTEM_HIERARCHY;
break;
case (libcstring_system_integer_t) 'o':
option_volume_offset = optarg;
break;
case (libcstring_system_integer_t) 'U':
option_mode = FSNTFSINFO_MODE_USER_JOURNAL;
break;
case (libcstring_system_integer_t) 'v':
verbose = 1;
break;
case (libcstring_system_integer_t) 'V':
fsntfsoutput_copyright_fprint(
stdout );
return( EXIT_SUCCESS );
}
}
if( optind == argc )
{
fprintf(
stderr,
"Missing source file or device.\n" );
usage_fprint(
stdout );
return( EXIT_FAILURE );
}
source = argv[ optind ];
libcnotify_verbose_set(
verbose );
libfsntfs_notify_set_stream(
stderr,
NULL );
libfsntfs_notify_set_verbose(
verbose );
if( info_handle_initialize(
&fsntfsinfo_info_handle,
&error ) != 1 )
{
fprintf(
stderr,
"Unable to initialize info handle.\n" );
goto on_error;
}
if( option_volume_offset != NULL )
{
if( info_handle_set_volume_offset(
fsntfsinfo_info_handle,
option_volume_offset,
&error ) != 1 )
{
libcnotify_print_error_backtrace(
error );
libcerror_error_free(
&error );
fprintf(
stderr,
"Unsupported volume offset defaulting to: %" PRIi64 ".\n",
fsntfsinfo_info_handle->volume_offset );
}
}
if( info_handle_open_input(
fsntfsinfo_info_handle,
source,
&error ) != 1 )
{
fprintf(
stderr,
"Unable to open: %" PRIs_LIBCSTRING_SYSTEM ".\n",
source );
goto on_error;
}
switch( option_mode )
{
case FSNTFSINFO_MODE_FILE_SYSTEM_HIERARCHY:
if( info_handle_file_system_hierarchy_fprint(
fsntfsinfo_info_handle,
&error ) != 1 )
{
fprintf(
stderr,
"Unable to print file system hierarchy.\n" );
goto on_error;
}
break;
case FSNTFSINFO_MODE_MFT_ENTRY:
if( option_mft_entry_index == NULL )
{
fprintf(
stderr,
"Mising MFT entry index string.\n" );
goto on_error;
}
string_length = libcstring_system_string_length(
option_mft_entry_index );
if( ( string_length == 3 )
&& ( libcstring_system_string_compare(
option_mft_entry_index,
_LIBCSTRING_SYSTEM_STRING( "all" ),
3 ) == 0 ) )
{
if( info_handle_mft_entries_fprint(
fsntfsinfo_info_handle,
&error ) != 1 )
{
fprintf(
stderr,
"Unable to print MFT entries.\n" );
goto on_error;
}
}
else if( libcsystem_string_decimal_copy_to_64_bit(
option_mft_entry_index,
string_length + 1,
&mft_entry_index,
&error ) == 1 )
{
if( info_handle_mft_entry_fprint(
fsntfsinfo_info_handle,
mft_entry_index,
&error ) != 1 )
{
fprintf(
stderr,
"Unable to print MFT entry: %" PRIu64 ".\n",
mft_entry_index );
goto on_error;
}
}
else
{
fprintf(
stderr,
"Unable to copy MFT entry index string to 64-bit decimal.\n" );
goto on_error;
}
break;
case FSNTFSINFO_MODE_USER_JOURNAL:
if( fsntfsinfo_info_handle->input_volume == NULL )
{
fprintf(
stderr,
"Unable to print user journal ($UsnJrnl) information.\n" );
goto on_error;
}
if( info_handle_user_journal_fprint(
fsntfsinfo_info_handle,
&error ) != 1 )
{
fprintf(
stderr,
"Unable to print user journal ($UsnJrnl) information.\n" );
goto on_error;
}
break;
case FSNTFSINFO_MODE_VOLUME:
default:
if( info_handle_volume_fprint(
fsntfsinfo_info_handle,
&error ) != 1 )
{
fprintf(
stderr,
"Unable to print volume information.\n" );
goto on_error;
}
break;
}
if( info_handle_close_input(
fsntfsinfo_info_handle,
&error ) != 0 )
{
fprintf(
stderr,
"Unable to close info handle.\n" );
goto on_error;
}
if( info_handle_free(
&fsntfsinfo_info_handle,
&error ) != 1 )
{
fprintf(
stderr,
"Unable to free info handle.\n" );
goto on_error;
}
return( EXIT_SUCCESS );
on_error:
if( error != NULL )
{
libcnotify_print_error_backtrace(
error );
libcerror_error_free(
&error );
}
if( fsntfsinfo_info_handle != NULL )
{
info_handle_free(
&fsntfsinfo_info_handle,
NULL );
}
return( EXIT_FAILURE );
}
