/** * Starts in a specified byte offset of the opened disk images and looks for a * file system. Will start processing the file system at a specified * file system. Will call processFile() on each file * that is found in that directory. * * @param a_start Byte offset of file system starting location. * @param a_ftype Type of file system that will be analyzed. * @param a_inum inum to start walking files system at. * * @returns 1 if an error occured (messages will have been registered) and 0 on success */ uint8_t TskAuto::findFilesInFs(TSK_OFF_T a_start, TSK_FS_TYPE_ENUM a_ftype, TSK_INUM_T a_inum) { if (!m_img_info) { tsk_error_reset(); tsk_error_set_errno(TSK_ERR_AUTO_NOTOPEN); tsk_error_set_errstr("findFilesInFs -- img_info "); registerError(); return 1; } TSK_FS_INFO *fs_info; if ((fs_info = tsk_fs_open_img(m_img_info, a_start, a_ftype)) == NULL) { if (getCurVsPartFlag() & TSK_VS_PART_FLAG_ALLOC) { tsk_error_set_errstr2( "Sector offset: %" PRIuOFF ", Partition Type: %s", a_start / 512, getCurVsPartDescr().c_str()); registerError(); return 1; } else { tsk_error_reset(); return 0; } } findFilesInFsInt(fs_info, a_inum); tsk_fs_close(fs_info); return m_errors.empty() ? 0 : 1; }
/** * Starts in a specified byte offset of the opened disk images and looks for a * file system. Will start processing the file system at a specified * file system. Will call processFile() on each file * that is found in that directory. * * @param a_start Byte offset of file system starting location. * @param a_ftype Type of file system that will be analyzed. * @param a_inum inum to start walking files system at. * * @returns 1 on error and 0 on success */ uint8_t TskAuto::findFilesInFs(TSK_OFF_T a_start, TSK_FS_TYPE_ENUM a_ftype, TSK_INUM_T a_inum) { if (!m_img_info) { tsk_error_reset(); tsk_error_set_errno(TSK_ERR_AUTO_NOTOPEN); tsk_error_set_errstr("findFilesInFs\n"); return 1; } TSK_FS_INFO *fs_info; /* Try it as a file system */ if ((fs_info = tsk_fs_open_img(m_img_info, a_start, a_ftype)) == NULL) { char msg[1024]; snprintf(msg, 1024, "Unable to open file system at offset %" PRIuOFF " (%s)", +a_start, tsk_error_get()); if (tsk_verbose) fprintf(stderr, "%s\n", msg); handleNotification(msg); /* We could do some carving on the volume data at this point */ return 1; } TSK_RETVAL_ENUM retval = findFilesInFsInt(fs_info, a_inum); tsk_fs_close(fs_info); if (retval == TSK_ERR) return 1; else return 0; }
/** * Starts in a specified byte offset of the opened disk images and looks for a * file system. Will call processFile() on each file * that is found. Same as findFilesInFs, but gives more detailed return values. * @param a_start Byte offset to start analyzing from. * @param a_ftype File system type. * @returns Error (messages will have been registered), OK, or STOP. */ TSK_RETVAL_ENUM TskAuto::findFilesInFsRet(TSK_OFF_T a_start, TSK_FS_TYPE_ENUM a_ftype) { if (!m_img_info) { tsk_error_reset(); tsk_error_set_errno(TSK_ERR_AUTO_NOTOPEN); tsk_error_set_errstr("findFilesInFsRet -- img_info"); registerError(); return TSK_ERR; } TSK_FS_INFO *fs_info; if ((fs_info = tsk_fs_open_img(m_img_info, a_start, a_ftype)) == NULL) { if (getCurVsPartFlag() & TSK_VS_PART_FLAG_ALLOC) { tsk_error_set_errstr2 ("Sector offset: %" PRIuOFF ", Partition Type: %s", a_start/512, getCurVsPartDescr().c_str() ); registerError(); return TSK_ERR; } else { tsk_error_reset(); return TSK_OK; } } TSK_RETVAL_ENUM retval = findFilesInFsInt(fs_info, fs_info->root_inum); tsk_fs_close(fs_info); if (m_errors.empty() == false) return TSK_ERR; else return retval; }
/** * Processes the file system represented by the given TSK_FS_INFO * pointer. Will Call processFile() on each file that is found. * * @param a_fs_info Pointer to a previously opened file system. * * @returns 1 on error and 0 on success */ uint8_t TskAuto::findFilesInFs(TSK_FS_INFO * a_fs_info) { if (a_fs_info == NULL) return 1; if (findFilesInFsInt(a_fs_info, a_fs_info->root_inum) == TSK_ERR) return 1; else return 0; }
/** * Processes the file system represented by the given TSK_FS_INFO * pointer. Will Call processFile() on each file that is found. * * @param a_fs_info Pointer to a previously opened file system. * * @returns 1 if an error occured (messages will have been registered) and 0 on success */ uint8_t TskAuto::findFilesInFs(TSK_FS_INFO * a_fs_info) { if (a_fs_info == NULL) { tsk_error_reset(); tsk_error_set_errno(TSK_ERR_AUTO_NOTOPEN); tsk_error_set_errstr("findFilesInFs - fs_info"); registerError(); return 1; } findFilesInFsInt(a_fs_info, a_fs_info->root_inum); return m_errors.empty() ? 0 : 1; }