示例#1
0
int TskImageFileTsk::extractFiles()
{
    // @@@ Add Sanity check that DB is empty 
    if (m_img_info == NULL) {
        LOGERROR(L"TskImageFileTsk::extractFiles: Images not open yet\n");
        return 1;
    }

    m_db.addImageInfo((int)m_img_info->itype, m_img_info->sector_size);

    for (uint32_t i = 0; i < m_images.size(); i++) {
        const char *img_ptr = NULL;
        img_ptr = m_images[i].c_str();
        m_db.addImageName(img_ptr);
     }

    TSKAutoImpl tskAutoImpl;
    if (tskAutoImpl.openImage(m_img_info)) 
    {
        std::wstringstream msg;
        msg << L"TSKExtract::processImage - Error opening image: " << tsk_error_get() << std::endl;
        LOGERROR(msg.str());
        return 1;
    }

    // TskAutoImpl will log errors as they occur
    tskAutoImpl.extractFiles();

    // It's possible that this is an image with no volumes or file systems.
    // Scan the image for file systems starting at sector 0.
    // By default it will scan 1024 sectors.
    if (m_db.getNumVolumes() == 0)
    {
        tskAutoImpl.scanImgForFs(0);
    }

    return 0;
}
int TskImageFileTsk::extractFiles()
{
    // @@@ Add Sanity check that DB is empty 
    if (m_img_info == NULL) {
        LOGERROR(L"TskImageFileTsk::extractFiles: Images not open yet\n");
        return 1;
    }

    m_db.addImageInfo((int)m_img_info->itype, m_img_info->sector_size);

    for (uint32_t i = 0; i < m_images.size(); i++) {
        char *img_ptr = NULL;
#ifdef TSK_WIN32
        char img2[1024];
        UTF8 *ptr8;
        UTF16 *ptr16;

        ptr8 = (UTF8 *) img2;
        ptr16 = (UTF16 *) m_images_ptrs[i];

        TSKConversionResult retval =
            tsk_UTF16toUTF8_lclorder((const UTF16 **) &ptr16, (UTF16 *)
            & ptr16[wcslen(m_images_ptrs[i]) + 1], &ptr8,
            (UTF8 *) ((uintptr_t) ptr8 + 1024), TSKlenientConversion);
        if (retval != TSKconversionOK) 
        {
            std::wstringstream msg;
            msg << L"TskImageFileTsk::extractFiles: Error converting image to UTF-8" << std::endl;
            LOGERROR(msg.str());

            return 1;
        }
        img_ptr = img2;
#else
        img_ptr = (char *) a_images[i];
#endif

        m_db.addImageName(img_ptr);
     }

    TSKAutoImpl tskAutoImpl;
    if (tskAutoImpl.openImage(m_img_info)) 
    {
        std::wstringstream msg;
        msg << L"TSKExtract::processImage - Error opening image: " << tsk_error_get() << std::endl;
        LOGERROR(msg.str());
        return 1;
    }

    // TskAutoImpl will log errors as they occur
    tskAutoImpl.findFilesInImg();

    // It's possible that this is an image with no volumes or file systems.
    // Scan the image for file systems starting at sector 0.
    // By default it will scan 1024 sectors.
    if (m_db.getNumVolumes() == 0)
    {
        tskAutoImpl.scanImgForFs(0);
    }

    return 0;
}