File: LogicalImagerExtensionRule.cpp

package info (click to toggle)
sleuthkit 4.12.1%2Bdfsg-3
  • links: PTS, VCS
  • area: main
  • in suites: forky, sid, trixie
  • size: 18,608 kB
  • sloc: ansic: 143,795; cpp: 52,225; java: 37,892; xml: 2,416; python: 1,076; perl: 874; makefile: 439; sh: 184
file content (54 lines) | stat: -rwxr-xr-x 1,539 bytes parent folder | download | duplicates (2)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
/*
** The Sleuth Kit
**
** Brian Carrier [carrier <at> sleuthkit [dot] org]
** Copyright (c) 2010-2019 Brian Carrier.  All Rights reserved
**
** This software is distributed under the Common Public License 1.0
**
*/

#include <shlwapi.h>
#include <string>
#include <algorithm>

#include "LogicalImagerExtensionRule.h"
#include "TskHelper.h"

/*
* Construct a file extension rule.
* 
* @param extensions A set of extension strings. The extension should not contain any period.
* Extension is case-insensitive. It it normalize to lowercase.
*/
LogicalImagerExtensionRule::LogicalImagerExtensionRule(const std::set<std::string> &extensions) {
    for (auto it = std::begin(extensions); it != std::end(extensions); ++it) {
        validatePath(*it);
        m_extensions.insert(TskHelper::toLower(*it));
    }
}

LogicalImagerExtensionRule::~LogicalImagerExtensionRule() {
    m_extensions.clear();
}

/**
* Match a file's extension against the logical imager extension set
*
* @param fs_file TSK_FS_FILE containing the filename
* @param path parent path to fs_file
* @returns true if extension matches this rule
*          false otherwise
*/
bool LogicalImagerExtensionRule::matches(TSK_FS_FILE *fs_file, const char * /*path*/) const {
    if (fs_file->name == NULL)
        return false;

    char *extension = PathFindExtensionA(fs_file->name->name);
    if (extension[0] == '.') {
        // skip the leading dot
        extension = &extension[1];
    }

    return m_extensions.find(TskHelper::toLower(extension)) != m_extensions.end();
}