int TskImageFileTsk::extractFiles()
{
// @@@ Add Sanity check that DB is empty
if (m_img_info == NULL) {
LOGERROR(L"TskImageFileTsk::extractFiles: Images not open yet\n");
return 1;
}
m_db.addImageInfo((int)m_img_info->itype, m_img_info->sector_size);
for (uint32_t i = 0; i < m_images.size(); i++) {
const char *img_ptr = NULL;
img_ptr = m_images[i].c_str();
m_db.addImageName(img_ptr);
}
TSKAutoImpl tskAutoImpl;
if (tskAutoImpl.openImage(m_img_info))
{
std::wstringstream msg;
msg << L"TSKExtract::processImage - Error opening image: " << tsk_error_get() << std::endl;
LOGERROR(msg.str());
return 1;
}
// TskAutoImpl will log errors as they occur
tskAutoImpl.extractFiles();
// It's possible that this is an image with no volumes or file systems.
// Scan the image for file systems starting at sector 0.
// By default it will scan 1024 sectors.
if (m_db.getNumVolumes() == 0)
{
tskAutoImpl.scanImgForFs(0);
}
return 0;
}
int TskImageFileTsk::extractFiles()
{
// @@@ Add Sanity check that DB is empty
if (m_img_info == NULL) {
LOGERROR(L"TskImageFileTsk::extractFiles: Images not open yet\n");
return 1;
}
m_db.addImageInfo((int)m_img_info->itype, m_img_info->sector_size);
for (uint32_t i = 0; i < m_images.size(); i++) {
char *img_ptr = NULL;
#ifdef TSK_WIN32
char img2[1024];
UTF8 *ptr8;
UTF16 *ptr16;
ptr8 = (UTF8 *) img2;
ptr16 = (UTF16 *) m_images_ptrs[i];
TSKConversionResult retval =
tsk_UTF16toUTF8_lclorder((const UTF16 **) &ptr16, (UTF16 *)
& ptr16[wcslen(m_images_ptrs[i]) + 1], &ptr8,
(UTF8 *) ((uintptr_t) ptr8 + 1024), TSKlenientConversion);
if (retval != TSKconversionOK)
{
std::wstringstream msg;
msg << L"TskImageFileTsk::extractFiles: Error converting image to UTF-8" << std::endl;
LOGERROR(msg.str());
return 1;
}
img_ptr = img2;
#else
img_ptr = (char *) a_images[i];
#endif
m_db.addImageName(img_ptr);
}
TSKAutoImpl tskAutoImpl;
if (tskAutoImpl.openImage(m_img_info))
{
std::wstringstream msg;
msg << L"TSKExtract::processImage - Error opening image: " << tsk_error_get() << std::endl;
LOGERROR(msg.str());
return 1;
}
// TskAutoImpl will log errors as they occur
tskAutoImpl.findFilesInImg();
// It's possible that this is an image with no volumes or file systems.
// Scan the image for file systems starting at sector 0.
// By default it will scan 1024 sectors.
if (m_db.getNumVolumes() == 0)
{
tskAutoImpl.scanImgForFs(0);
}
return 0;
}
