/**
* Starts in a specified byte offset of the opened disk images and looks for a
* file system. Will start processing the file system at a specified
* file system. Will call processFile() on each file
* that is found in that directory.
*
* @param a_start Byte offset of file system starting location.
* @param a_ftype Type of file system that will be analyzed.
* @param a_inum inum to start walking files system at.
*
* @returns 1 if an error occured (messages will have been registered) and 0 on success
*/
uint8_t
TskAuto::findFilesInFs(TSK_OFF_T a_start, TSK_FS_TYPE_ENUM a_ftype,
TSK_INUM_T a_inum)
{
if (!m_img_info) {
tsk_error_reset();
tsk_error_set_errno(TSK_ERR_AUTO_NOTOPEN);
tsk_error_set_errstr("findFilesInFs -- img_info ");
registerError();
return 1;
}
TSK_FS_INFO *fs_info;
if ((fs_info = tsk_fs_open_img(m_img_info, a_start, a_ftype)) == NULL) {
if (getCurVsPartFlag() & TSK_VS_PART_FLAG_ALLOC) {
tsk_error_set_errstr2(
"Sector offset: %" PRIuOFF ", Partition Type: %s",
a_start / 512, getCurVsPartDescr().c_str());
registerError();
return 1;
}
else {
tsk_error_reset();
return 0;
}
}
findFilesInFsInt(fs_info, a_inum);
tsk_fs_close(fs_info);
return m_errors.empty() ? 0 : 1;
}
/**
* Starts in a specified byte offset of the opened disk images and looks for a
* file system. Will start processing the file system at a specified
* file system. Will call processFile() on each file
* that is found in that directory.
*
* @param a_start Byte offset of file system starting location.
* @param a_ftype Type of file system that will be analyzed.
* @param a_inum inum to start walking files system at.
*
* @returns 1 on error and 0 on success
*/
uint8_t
TskAuto::findFilesInFs(TSK_OFF_T a_start, TSK_FS_TYPE_ENUM a_ftype,
TSK_INUM_T a_inum)
{
if (!m_img_info) {
tsk_error_reset();
tsk_error_set_errno(TSK_ERR_AUTO_NOTOPEN);
tsk_error_set_errstr("findFilesInFs\n");
return 1;
}
TSK_FS_INFO *fs_info;
/* Try it as a file system */
if ((fs_info = tsk_fs_open_img(m_img_info, a_start, a_ftype)) == NULL) {
char msg[1024];
snprintf(msg, 1024,
"Unable to open file system at offset %" PRIuOFF " (%s)",
+a_start, tsk_error_get());
if (tsk_verbose)
fprintf(stderr, "%s\n", msg);
handleNotification(msg);
/* We could do some carving on the volume data at this point */
return 1;
}
TSK_RETVAL_ENUM retval = findFilesInFsInt(fs_info, a_inum);
tsk_fs_close(fs_info);
if (retval == TSK_ERR)
return 1;
else
return 0;
}
/**
* Starts in a specified byte offset of the opened disk images and looks for a
* file system. Will call processFile() on each file
* that is found. Same as findFilesInFs, but gives more detailed return values.
* @param a_start Byte offset to start analyzing from.
* @param a_ftype File system type.
* @returns Error (messages will have been registered), OK, or STOP.
*/
TSK_RETVAL_ENUM
TskAuto::findFilesInFsRet(TSK_OFF_T a_start, TSK_FS_TYPE_ENUM a_ftype)
{
if (!m_img_info) {
tsk_error_reset();
tsk_error_set_errno(TSK_ERR_AUTO_NOTOPEN);
tsk_error_set_errstr("findFilesInFsRet -- img_info");
registerError();
return TSK_ERR;
}
TSK_FS_INFO *fs_info;
if ((fs_info = tsk_fs_open_img(m_img_info, a_start, a_ftype)) == NULL) {
if (getCurVsPartFlag() & TSK_VS_PART_FLAG_ALLOC) {
tsk_error_set_errstr2 ("Sector offset: %" PRIuOFF ", Partition Type: %s",
a_start/512, getCurVsPartDescr().c_str() );
registerError();
return TSK_ERR;
}
else {
tsk_error_reset();
return TSK_OK;
}
}
TSK_RETVAL_ENUM retval = findFilesInFsInt(fs_info, fs_info->root_inum);
tsk_fs_close(fs_info);
if (m_errors.empty() == false)
return TSK_ERR;
else
return retval;
}
/**
* Processes the file system represented by the given TSK_FS_INFO
* pointer. Will Call processFile() on each file that is found.
*
* @param a_fs_info Pointer to a previously opened file system.
*
* @returns 1 on error and 0 on success
*/
uint8_t
TskAuto::findFilesInFs(TSK_FS_INFO * a_fs_info)
{
if (a_fs_info == NULL)
return 1;
if (findFilesInFsInt(a_fs_info, a_fs_info->root_inum) == TSK_ERR)
return 1;
else
return 0;
}
/**
* Processes the file system represented by the given TSK_FS_INFO
* pointer. Will Call processFile() on each file that is found.
*
* @param a_fs_info Pointer to a previously opened file system.
*
* @returns 1 if an error occured (messages will have been registered) and 0 on success
*/
uint8_t
TskAuto::findFilesInFs(TSK_FS_INFO * a_fs_info)
{
if (a_fs_info == NULL) {
tsk_error_reset();
tsk_error_set_errno(TSK_ERR_AUTO_NOTOPEN);
tsk_error_set_errstr("findFilesInFs - fs_info");
registerError();
return 1;
}
findFilesInFsInt(a_fs_info, a_fs_info->root_inum);
return m_errors.empty() ? 0 : 1;
}