File: LogicalImagerFilenameRule.cpp

package info (click to toggle)
sleuthkit 4.12.1%2Bdfsg-3
  • links: PTS, VCS
  • area: main
  • in suites: forky, sid, trixie
  • size: 18,608 kB
  • sloc: ansic: 143,795; cpp: 52,225; java: 37,892; xml: 2,416; python: 1,076; perl: 874; makefile: 439; sh: 184
file content (54 lines) | stat: -rwxr-xr-x 1,504 bytes parent folder | download | duplicates (2)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
/*
** The Sleuth Kit
**
** Brian Carrier [carrier <at> sleuthkit [dot] org]
** Copyright (c) 2010-2019 Brian Carrier.  All Rights reserved
**
** This software is distributed under the Common Public License 1.0
**
*/

#include <string>
#include <algorithm>

#include "LogicalImagerFilenameRule.h"
#include "TskHelper.h"

/*
* Construct a filename rule.
*
* @param filenames A set of filename strings. The filename should not contain any parent path.
* The filenames is case-insensitive. It it normalize to lowercase.
*/
LogicalImagerFilenameRule::LogicalImagerFilenameRule(const std::set<std::string> &filenames) {
    for (auto it = std::begin(filenames); it != std::end(filenames); ++it) {
        validatePath(*it);
        m_filenames.insert(TskHelper::toLower(*it));
    }
}

LogicalImagerFilenameRule::~LogicalImagerFilenameRule() {
    m_filenames.clear();
}

/**
* Match a filename against the logical imager filename set
*
* @param fs_file TSK_FS_FILE containing the filename
* @param path parent path to fs_file
* @returns true if filename matches this rule
*          false otherwise
*/
bool LogicalImagerFilenameRule::matches(TSK_FS_FILE *fs_file, const char * /*path*/) const {
    if (fs_file->name == NULL)
        return false;

    std::string lowercaseFilename = TskHelper::toLower(fs_file->name->name);

    for (auto it = std::begin(m_filenames); it != std::end(m_filenames); ++it) {
        if (lowercaseFilename == *it) {
            return true;
        }
    }
    return false;
}