1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
|
/*
** img_types
** The Sleuth Kit
**
** Identify the type of image file being used
**
** Brian Carrier [carrier <at> sleuthkit [dot] org]
** Copyright (c) 2006-2011 Brian Carrier. All rights reserved
**
** This software is distributed under the Common Public License 1.0
*/
/** \file img_types.c
* Contains basic functions to parse and print the names of the supported disk image types.
*/
#include "tsk_img_i.h"
/** \internal
* used to parse and print supported types
*/
typedef struct {
char *name;
uint16_t code;
char *comment;
} IMG_TYPES;
/** \internal
* The table used to parse input strings
* - in order of expected usage
*/
static IMG_TYPES img_open_table[] = {
{"raw", TSK_IMG_TYPE_RAW, "Single or split raw file (dd)"},
#if HAVE_LIBAFFLIB
{"aff", TSK_IMG_TYPE_AFF_AFF, "Advanced Forensic Format"},
{"afd", TSK_IMG_TYPE_AFF_AFD, "AFF Multiple File"},
{"afm", TSK_IMG_TYPE_AFF_AFM, "AFF with external metadata"},
{"afflib", TSK_IMG_TYPE_AFF_ANY,
"All AFFLIB image formats (including beta ones)"},
#endif
#if HAVE_LIBEWF
{"ewf", TSK_IMG_TYPE_EWF_EWF, "Expert Witness Format (EnCase)"},
#endif
#if HAVE_LIBVMDK
{"vmdk", TSK_IMG_TYPE_VMDK_VMDK, "Virtual Machine Disk (VmWare, Virtual Box)"},
#endif
#if HAVE_LIBVHDI
{"vhd", TSK_IMG_TYPE_VHD_VHD, "Virtual Hard Drive (Microsoft)"},
#endif
#ifdef TSK_WIN32
{"logical", TSK_IMG_TYPE_LOGICAL, "Logical Directory"},
#endif
{0,0,""},
};
/**
* \ingroup imglib
* Parses a string that specifies an image format to determine the
* associated type ID. This is used by the TSK command line tools to
* parse the type given on the command line.
*
* @param str String of image format type, always UTF-8
* @return ID of image type
*/
TSK_IMG_TYPE_ENUM
tsk_img_type_toid_utf8(const char *str)
{
IMG_TYPES *sp;
for (sp = img_open_table; sp->name; sp++) {
if (strcmp(str, sp->name) == 0) {
return sp->code;
}
}
return TSK_IMG_TYPE_UNSUPP;
}
/**
* \ingroup imglib
* Parses a string that specifies an image format to determine the
* associated type ID. This is used by the TSK command line tools to
* parse the type given on the command line.
*
* @param str String of image format type
* @return ID of image type
*/
TSK_IMG_TYPE_ENUM
tsk_img_type_toid(const TSK_TCHAR * str)
{
char tmp[16];
int i;
// convert to char
for (i = 0; i < 15 && str[i] != '\0'; i++) {
tmp[i] = (char) str[i];
}
tmp[i] = '\0';
return tsk_img_type_toid_utf8(tmp);
}
/**
* \ingroup imglib
* Prints the name and description of the supported image types to a handle.
* This is used by the TSK command line tools to print the supported types
* to the console.
* @param hFile Handle to print names and descriptions to.
*/
void
tsk_img_type_print(FILE * hFile)
{
IMG_TYPES *sp;
tsk_fprintf(hFile, "Supported image format types:\n");
for (sp = img_open_table; sp->name; sp++)
tsk_fprintf(hFile, "\t%s (%s)\n", sp->name, sp->comment);
}
/**
* \ingroup imglib
* Returns the name of an image format type, given its type ID.
* @param type ID of image type
* @returns Pointer to string of the name.
*/
const char *
tsk_img_type_toname(TSK_IMG_TYPE_ENUM type)
{
IMG_TYPES *sp;
for (sp = img_open_table; sp->name; sp++)
if (sp->code == type)
return sp->name;
return NULL;
}
/**
* \ingroup imglib
* Returns the description of an image format type, given its type ID.
* @param type ID of image type
* @returns Pointer to string of the description
*/
const char *
tsk_img_type_todesc(TSK_IMG_TYPE_ENUM type)
{
IMG_TYPES *sp;
for (sp = img_open_table; sp->name; sp++)
if (sp->code == type)
return sp->comment;
return NULL;
}
/**
* \ingroup imglib
* Returns the supported file format types.
* @returns A bit in the return value is set to 1 if the type is supported.
*/
TSK_IMG_TYPE_ENUM
tsk_img_type_supported()
{
TSK_IMG_TYPE_ENUM sup_types = 0;
IMG_TYPES *sp;
for (sp = img_open_table; sp->name; sp++) {
sup_types |= sp->code;
}
return sup_types;
}
|
