Пример #1
0
/* Return 0 on success and 1 on error */
uint8_t
fs_ffind(FS_INFO * fs, uint8_t lclflags, INUM_T inode_a, uint32_t type,
    uint16_t id, int flags)
{

    found = 0;
    localflags = lclflags;
    inode = inode_a;

    /* Since we start the walk on the root inode, then this will not show
     ** up in the above functions, so do it now
     */
    if (inode == fs->root_inum) {
	if (flags & FS_FLAG_NAME_ALLOC) {
//	    printf("/\n");
            sprintf(found_path, "/");
	    found = 1;

	    if (!(lclflags & FFIND_ALL))
		return 0;
	}
    }

    if ((fs->ftype & FSMASK) == NTFS_TYPE) {
	if (ntfs_find_file(fs, inode, type, id, flags, find_file_act,
		NULL))
	    return 1;
    }
    else {
	if (fs->dent_walk(fs, fs->root_inum, flags, find_file_act, NULL))
	    return 1;
    }

#if 0
    if (found == 0) {

	/* With FAT, we can at least give the name of the file and call
	 * it orphan 
	 */
	if ((fs->ftype & FSMASK) == FATFS_TYPE) {
	    FS_INODE *fs_inode = fs->inode_lookup(fs, inode);
	    if ((fs_inode != NULL) && (fs_inode->name != NULL)) {
		if (fs_inode->flags & FS_FLAG_NAME_UNALLOC)
		    printf("* ");
		printf("%s/%s\n", ORPHAN_STR, fs_inode->name->name);
	    }
	    if (fs_inode)
		fs_inode_free(fs_inode);
	}
	else {
	    printf("inode not currently used\n");
	}
    }
#endif
    return (found == 0);
}
Пример #2
0
// XXX([email protected]): had better fix the comment
// find file of the given inode
// 
// \param fs         filesystem info structure defined in sleuthkit
// \param lclflags   traverse options defined in sleuthkit
// \param a_inode    the inode of the file
// \param type       filesystem type number
// \param type_used  don't know what it is, just give a 0(XXX)
// \param id         the id of file attribute that the inode refers
// \param id_used    don't know what it is, just give a 0(XXX)
// \param flags      traverse options difned in sleuthkit
// 
// Return 0 if error, otherwise a pointer
static MBA_FFIND_DATA*
fs_ffind(TSK_FS_INFO * fs, TSK_FS_FFIND_FLAG_ENUM lclflags,
    TSK_INUM_T a_inode,
    TSK_FS_ATTR_TYPE_ENUM type, uint8_t type_used,
    uint16_t id, uint8_t id_used, TSK_FS_DIR_WALK_FLAG_ENUM flags)
{
    MBA_FFIND_DATA* data=(MBA_FFIND_DATA*)malloc(sizeof(MBA_FFIND_DATA));
    char* orphan =NULL;
    int size = 0;

    if(data == NULL)
    {
        printf("Cannot allocate memory\n");
        return NULL;
    }

    data->found = 0;
    data->flags = lclflags;
    data->inode = a_inode;
    utarray_new(data->filenames, &ut_str_icd);


    /* Since we start the walk on the root inode, then this will not show
     ** up in the above functions, so do it now
     */
    if (data->inode == fs->root_inum) {
        if (flags & TSK_FS_DIR_WALK_FLAG_ALLOC) {
            //tsk_printf("/\n");
            data->found = 1;

            if (!(lclflags & TSK_FS_FFIND_ALL))
                return data;
        }
    }

    if (TSK_FS_TYPE_ISNTFS(fs->ftype)) {
        if (ntfs_find_file(fs, data->inode, type, type_used, id, id_used,
                flags, find_file_act, data))
            return NULL;
    }
    else {
        if (tsk_fs_dir_walk(fs, fs->root_inum, flags, find_file_act,
                data))
            return NULL;
    }

    if (data->found == 0) {

        /* With FAT, we can at least give the name of the file and call
         * it orphan
         */
        if (TSK_FS_TYPE_ISFAT(fs->ftype)) {
            TSK_FS_FILE *fs_file =
                tsk_fs_file_open_meta(fs, NULL, data->inode);
            if ((fs_file != NULL) && (fs_file->meta != NULL)
                && (fs_file->meta->name2 != NULL)) {
                //if (fs_file->meta->flags & TSK_FS_META_FLAG_UNALLOC)
                //    tsk_printf("* ");
                //tsk_printf("%s/%s\n", TSK_FS_ORPHAN_STR,
                //    fs_file->meta->name2->name);

                //Added Ophan file into file list
                size = strlen(TSK_FS_ORPHAN_STR) + strlen(fs_file->meta->name2->name)+2;
                orphan = (char*)malloc(size);
                if(orphan == NULL)
                {
                    printf("Cannot allocate memory\n");
                }else
                {
                    snprintf(orphan, size, "%s/%s", TSK_FS_ORPHAN_STR,fs_file->meta->name2->name);
                    utarray_push_back(data->filenames, orphan );
                }
            }
            if (fs_file)
                tsk_fs_file_close(fs_file);
        }
        else {
            tsk_printf("File name not found for inode\n");
        }
    }
    return data;
}