1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
|
/*
** The Sleuth Kit
**
** Brian Carrier [carrier <at> sleuthkit [dot] org]
** Copyright (c) 2010-2021 Brian Carrier. All Rights reserved
**
** This software is distributed under the Common Public License 1.0
**
*/
/**
* \file tsk_is_image_supported.cpp
* Class to test whether a given image can be processed by tsk
*
* Usage:
* Create a TskIsImageSupported object
* Call openImage
* Call findFilesInImg
* Call isImageSupported - if this returns true then the image is supported. If false or
* if there was an error along the way, the image is not supported
*/
#include "tsk_is_image_supported.h"
TskIsImageSupported::TskIsImageSupported()
{
m_wasDataFound = false;
m_wasEncryptionFound = false;
m_wasPossibleEncryptionFound = false;
m_wasFileSystemFound = false;
m_wasUnsupported = false;
m_encryptionDesc[0] = '\0';
m_possibleEncryptionDesc[0] = '\0';
m_unsupportedDesc[0] = '\0';
}
bool TskIsImageSupported::isImageSupported()
{
return m_wasDataFound;
}
bool TskIsImageSupported::isImageEncrypted()
{
return m_wasEncryptionFound;
}
void TskIsImageSupported::printResults() {
printf("Encryption: ");
if (!m_wasEncryptionFound && !m_wasPossibleEncryptionFound) {
printf("None");
}
else if (m_wasEncryptionFound) {
if (m_wasFileSystemFound) {
printf("Partial");
}
else {
printf("Full Disk");
}
}
else {
if (m_wasFileSystemFound) {
printf("Possible Partial");
}
else {
printf("Possible Full Disk");
}
}
printf("\n");
printf("Encryption Type: ");
if (strnlen(m_encryptionDesc, 1024) > 0) {
printf("%s", m_encryptionDesc);
}
else if (strnlen(m_possibleEncryptionDesc, 1024) > 0) {
printf("%s", m_possibleEncryptionDesc);
}
else {
printf("None");
}
printf("\n");
printf("TSK Support: ");
if (m_wasFileSystemFound) {
printf("Yes");
}
else {
printf("No");
if (strnlen(m_unsupportedDesc, 1024) > 0) {
printf(" (%s)", m_unsupportedDesc);
}
}
printf("\n");
}
uint8_t TskIsImageSupported::handleError()
{
// If encryption was found, update the flags
TSK_ERROR_INFO* lastError = tsk_error_get_info();
if (lastError != NULL) {
uint32_t errCode = lastError->t_errno;
if (errCode == TSK_ERR_FS_ENCRYPTED || errCode == TSK_ERR_VS_ENCRYPTED) {
strncpy(m_encryptionDesc, lastError->errstr, 1024);
m_wasEncryptionFound = true;
}
else if (errCode == TSK_ERR_FS_POSSIBLY_ENCRYPTED) {
strncpy(m_possibleEncryptionDesc, lastError->errstr, 1024);
m_wasPossibleEncryptionFound = true;
}
else if (errCode == TSK_ERR_IMG_UNSUPTYPE) {
strncpy(m_unsupportedDesc, lastError->errstr, 1024);
m_wasUnsupported = true;
}
else if (errCode == TSK_ERR_VS_MULTTYPE) {
// errstr only contains the "MAC or DOS" part, so add more context
strncpy(m_unsupportedDesc, "Multiple volume system types found - ", 1024);
strncat(m_unsupportedDesc, lastError->errstr, 950);
m_wasUnsupported = true;
}
else if (errCode == TSK_ERR_FS_MULTTYPE) {
// errstr only contains the "UFS or NTFS" part, so add more context
strncpy(m_unsupportedDesc, "Multiple file system types found - ", 1024);
strncat(m_unsupportedDesc, lastError->errstr, 950);
m_wasUnsupported = true;
}
}
return 0;
}
TSK_RETVAL_ENUM TskIsImageSupported::processFile(TSK_FS_FILE * /*fs_file*/,
const char * /*path*/)
{
return TSK_OK;
}
TSK_FILTER_ENUM
TskIsImageSupported::filterFs(TSK_FS_INFO * /*fs_info*/)
{
m_wasDataFound = true;
m_wasFileSystemFound = true;
return TSK_FILTER_SKIP;
}
TSK_FILTER_ENUM
TskIsImageSupported::filterPool(const TSK_POOL_INFO * pool_info)
{
// There's nothing to do, but we need to override this to allow the pool
// to be processed.
return TSK_FILTER_CONT;
}
TSK_FILTER_ENUM
TskIsImageSupported::filterPoolVol(const TSK_POOL_VOLUME_INFO * pool_vol)
{
// There's nothing to do, but we need to override this to allow the pool
// to be processed.
return TSK_FILTER_CONT;
}
TSK_FILTER_ENUM
TskIsImageSupported::filterVol(const TSK_VS_PART_INFO * /*vs_part*/)
{
m_wasDataFound = true;
return TSK_FILTER_CONT;
}
|
