Exemplo n.º 1
0
Arquivo: tsk3.c Projeto: py4n6/aff4
static Img_Info Img_Info_Con(Img_Info self, char *urn, TSK_IMG_TYPE_ENUM type) {
  if(urn[0]) {
#ifdef TSK_VERSION_NUM
    self->img = (Extended_TSK_IMG_INFO *)tsk_img_open_utf8(1, (const char **)&urn, type, 0);
#else
    self->img = (Extended_TSK_IMG_INFO *)tsk_img_open_utf8(1, (const char **)&urn, type);
#endif
  } else {
    // Initialise the img struct with the correct callbacks:
    self->img = talloc_zero(self, Extended_TSK_IMG_INFO);
    self->img->container = self;

    self->img->base.read = IMG_INFO_read;
    self->img->base.close = IMG_INFO_close;
    self->img->base.size = CALL(self, get_size);

#ifdef TSK_VERSION_NUM
    self->img->base.sector_size = 512;
#endif
    self->img->base.itype = TSK_IMG_TYPE_RAW_SING;
  };

  if(!self->img) {
    RaiseError(ERuntimeError, "Unable to open image: %s", tsk_error_get());
    goto error;
  };

  talloc_set_destructor((void *)self, Img_Info_dest);
  return self;
 error:
  talloc_free(self);
  return NULL;
};
Exemplo n.º 2
0
/**
* \ingroup imglib
 * Opens a single (non-split) disk image file so that it can be read.  This version
 * always takes a UTF-8 encoding of the disk image.  See tsk_img_open_sing() for a
 * version that takes a wchar_t or char depending on the platform. 
 * This is a wrapper around tsk_img_open().  See it for more details on detection etc. 
 *
 * @param a_image The UTF-8 path to the image file 
 * @param type The disk image type (can be autodetection)
 * @param a_ssize Size of device sector in bytes (or 0 for default)
 *
 * @return Pointer to TSK_IMG_INFO or NULL on error
 */
TSK_IMG_INFO *
tsk_img_open_utf8_sing(const char *a_image, TSK_IMG_TYPE_ENUM type,
    unsigned int a_ssize)
{
    const char *const a = a_image;
    return tsk_img_open_utf8(1, &a, type, a_ssize);
}
Exemplo n.º 3
0
/**
 * Open the image using the names that were already populated in
 * m_images.  Used internally by both open() methods.
 * @returns -1 on error.
 */
int TskImageFileTsk::openImages(const TSK_IMG_TYPE_ENUM imageType,
                                const unsigned int sectorSize) 
{
    m_images_ptrs = (const char **)malloc(m_images.size() * sizeof(char *));
    if (m_images_ptrs == NULL)
        return -1;

    int i = 0;
    for(std::vector<std::string>::iterator list_iter = m_images.begin(); 
        list_iter != m_images.end(); list_iter++) {
            m_images_ptrs[i++] = (*list_iter).c_str();
    }

    m_img_info = tsk_img_open_utf8(i, m_images_ptrs, imageType, sectorSize);
    if (m_img_info == NULL) 
    {
        std::wstringstream logMessage;
        logMessage << L"TskImageFileTsk::openImages - Error with tsk_img_open: " << tsk_error_get() << std::endl;
        LOGERROR(logMessage.str());

        return -1;
    }

    return 0;
}
Exemplo n.º 4
0
/**
 * Opens the disk image to be analyzed.  This must be called before any
 * of the findFilesInXXX() methods. Always uses the utf8 tsk_img_open
 * even in windows.
 *
 * @param a_numImg The number of images to open (will be > 1 for split images).
 * @param a_images The path to the image files (the number of files must
 * be equal to num_img and they must be in a sorted order)
 * @param a_imgType The disk image type (can be autodetection)
 * @param a_sSize Size of device sector in bytes (or 0 for default)
 * @returns 1 on error, 0 on success
 */
uint8_t
    TskAuto::openImageUtf8(int a_numImg, const char *const a_images[],
    TSK_IMG_TYPE_ENUM a_imgType, unsigned int a_sSize)
{
    if (m_img_info)
        closeImage();

    m_internalOpen = true;
    m_img_info = tsk_img_open_utf8(a_numImg, a_images, a_imgType, a_sSize);
    if (m_img_info)
        return 0;
    else
        return 1;
}
/*
 * Open an image pointer for the given image
 * @return the created TSK_IMG_INFO pointer
 * @param env pointer to java environment this was called from
 * @param obj the java object this was called from
 * @param paths the paths to the image parts
 * @param num_imgs number of image parts
 */
JNIEXPORT jlong JNICALL
    Java_org_sleuthkit_datamodel_SleuthkitJNI_openImgNat(JNIEnv * env,
    jclass obj, jobjectArray paths, jint num_imgs) {
    TSK_IMG_INFO *img_info;
    jboolean isCopy;

    // get pointers to each of the file names
    char **imagepaths8 = (char **) tsk_malloc(num_imgs * sizeof(char *));
    if (imagepaths8 == NULL) {
        throwTskError(env);
        return NULL;
    }
    for (int i = 0; i < num_imgs; i++) {
        imagepaths8[i] =
            (char *) env->
            GetStringUTFChars((jstring) env->GetObjectArrayElement(paths,
                i), &isCopy);
        // @@@ Error check
    }

    // open the image
    img_info =
        tsk_img_open_utf8((int) num_imgs, imagepaths8, TSK_IMG_TYPE_DETECT,
        0);
    if (img_info == NULL) {
        throwTskError(env, tsk_error_get());
    }

    // cleanup
    for (int i = 0; i < num_imgs; i++) {
        env->
            ReleaseStringUTFChars((jstring)
            env->GetObjectArrayElement(paths, i), imagepaths8[i]);
    }
    free(imagepaths8);

    return (jlong) img_info;
}