libewf_file.c

来自「sleuthit-2.09 一个磁盘的工具集」· C语言 代码 · 共 1,186 行 · 第 1/3 页

	return( libewf_internal_handle_get_media_type( (LIBEWF_INTERNAL_HANDLE *) handle ) );
}

/* Returns the media flags value, or -1 on error
 */
int8_t libewf_get_media_flags( LIBEWF_HANDLE *handle )
{
	return( libewf_internal_handle_get_media_flags( (LIBEWF_INTERNAL_HANDLE *) handle ) );
}

/* Returns the volume type value, or -1 on error
 */
int8_t libewf_get_volume_type( LIBEWF_HANDLE *handle )
{
	return( libewf_internal_handle_get_volume_type( (LIBEWF_INTERNAL_HANDLE *) handle ) );
}

/* Returns the format value, or -1 on error
 */
int8_t libewf_get_format( LIBEWF_HANDLE *handle )
{
	return( libewf_internal_handle_get_format( (LIBEWF_INTERNAL_HANDLE *) handle ) );
}

/* Returns 1 if the GUID is set, or -1 on error
 */
int8_t libewf_get_guid( LIBEWF_HANDLE *handle, uint8_t *guid, size_t size )
{
	return( libewf_internal_handle_get_guid( (LIBEWF_INTERNAL_HANDLE *) handle, guid, size ) );
}

/* Returns the amount of chunks written, 0 if no chunks have been written, or -1 on error
 */
int64_t libewf_get_write_amount_of_chunks( LIBEWF_HANDLE *handle )
{
	return( libewf_internal_handle_get_write_amount_of_chunks( (LIBEWF_INTERNAL_HANDLE *) handle ) );
}

/* Retrieves the header value specified by the identifier
 * Returns 1 if successful, 0 if value not present, -1 on error
 */
int8_t libewf_get_header_value( LIBEWF_HANDLE *handle, LIBEWF_CHAR *identifier, LIBEWF_CHAR *value, size_t length )
{
	return( libewf_internal_handle_get_header_value( (LIBEWF_INTERNAL_HANDLE *) handle, identifier, value, length ) );
}

/* Retrieves the hash value specified by the identifier
 * Returns 1 if successful, 0 if value not present, -1 on error
 */
int8_t libewf_get_hash_value( LIBEWF_HANDLE *handle, LIBEWF_CHAR *identifier, LIBEWF_CHAR *value, size_t length )
{
	return( libewf_internal_handle_get_hash_value( (LIBEWF_INTERNAL_HANDLE *) handle, identifier, value, length ) );
}

/* Sets the media values
 * Returns 1 if successful, -1 on error
 */
int8_t libewf_set_media_values( LIBEWF_HANDLE *handle, uint32_t sectors_per_chunk, uint32_t bytes_per_sector )
{
	return( libewf_internal_handle_set_media_values( (LIBEWF_INTERNAL_HANDLE *) handle, sectors_per_chunk, bytes_per_sector ) );
}

/* Returns 1 if the GUID is set, or -1 on error
 */
int8_t libewf_set_guid( LIBEWF_HANDLE *handle, uint8_t *guid, size_t size )
{
	return( libewf_internal_handle_set_guid( (LIBEWF_INTERNAL_HANDLE *) handle, guid, size ) );
}

/* Sets the write segment file size
 * Returns 1 if successful, -1 on error
 */
int8_t libewf_set_write_segment_file_size( LIBEWF_HANDLE *handle, uint32_t segment_file_size )
{
	return( libewf_internal_handle_set_write_segment_file_size( (LIBEWF_INTERNAL_HANDLE *) handle, segment_file_size ) );
}

/* Sets the write error granularity
 * Returns 1 if successful, -1 on error
 */
int8_t libewf_set_write_error_granularity( LIBEWF_HANDLE *handle, uint32_t error_granularity )
{
	return( libewf_internal_handle_set_write_error_granularity( (LIBEWF_INTERNAL_HANDLE *) handle, error_granularity ) );
}

/* Sets the write compression values
 * Returns 1 if successful, -1 on error
 */
int8_t libewf_set_write_compression_values( LIBEWF_HANDLE *handle, int8_t compression_level, uint8_t compress_empty_block )
{
	return( libewf_internal_handle_set_write_compression_values( (LIBEWF_INTERNAL_HANDLE *) handle, compression_level, compress_empty_block ) );
}

/* Sets the media type
 * Returns 1 if successful, -1 on error
 */
int8_t libewf_set_write_media_type( LIBEWF_HANDLE *handle, uint8_t media_type, uint8_t volume_type )
{
	return( libewf_internal_handle_set_write_media_type( (LIBEWF_INTERNAL_HANDLE *) handle, media_type, volume_type ) );
}

/* Sets the write output format
 * Returns 1 if successful, -1 on error
 */
int8_t libewf_set_write_format( LIBEWF_HANDLE *handle, uint8_t format )
{
	return( libewf_internal_handle_set_write_format( (LIBEWF_INTERNAL_HANDLE *) handle, format ) );
}

/* Sets the write input size
 * Returns 1 if successful, -1 on error
 */
int8_t libewf_set_write_input_size( LIBEWF_HANDLE *handle, uint64_t input_write_size )
{
	return( libewf_internal_handle_set_write_input_write_size( (LIBEWF_INTERNAL_HANDLE *) handle, input_write_size ) );
}

/* Sets the header value specified by the identifier
 * Returns 1 if successful, -1 on error
 */
int8_t libewf_set_header_value( LIBEWF_HANDLE *handle, LIBEWF_CHAR *identifier, LIBEWF_CHAR *value, size_t length )
{
	return( libewf_internal_handle_set_header_value( (LIBEWF_INTERNAL_HANDLE *) handle, identifier, value, length ) );
}

/* Sets the hash value specified by the identifier
 * Returns 1 if successful, -1 on error
 */
int8_t libewf_set_hash_value( LIBEWF_HANDLE *handle, LIBEWF_CHAR *identifier, LIBEWF_CHAR *value, size_t length )
{
	return( libewf_internal_handle_set_hash_value( (LIBEWF_INTERNAL_HANDLE *) handle, identifier, value, length ) );
}

/* Sets the swap byte pairs, used by both read and write
 * Returns 1 if successful, -1 on error
 */
int8_t libewf_set_swap_byte_pairs( LIBEWF_HANDLE *handle, uint8_t swap_byte_pairs )
{
	return( libewf_internal_handle_set_swap_byte_pairs( (LIBEWF_INTERNAL_HANDLE *) handle, swap_byte_pairs ) );
}

/* Calculates the MD5 hash and creates a printable string of the calculated md5 hash
 * Returns 1 if successful, -1 on error
 */
int8_t libewf_calculate_md5_hash( LIBEWF_HANDLE *handle, LIBEWF_CHAR *string, size_t length )
{
	LIBEWF_INTERNAL_HANDLE *internal_handle = NULL;
	uint8_t *data                           = NULL;
	off_t offset                            = 0;
	ssize_t count                           = 0;
	uint32_t iterator                       = 0;

	if( handle == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_calculate_md5_hash: invalid handle.\n" );

		return( -1 );
	}
	internal_handle = (LIBEWF_INTERNAL_HANDLE *) internal_handle;

	if( internal_handle->media == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_calculate_md5_hash: invalid handle - missing subhandle media.\n" );

		return( -1 );
	}
	if( string == NULL )
	{
		LIBEWF_VERBOSE_PRINT( "libewf_calculate_md5_hash: invalid string.\n" );

		return( -1 );
	}
	if( length < LIBEWF_STRING_DIGEST_HASH_LENGTH_MD5 )
	{
		LIBEWF_VERBOSE_PRINT( "libewf_calculate_md5_hash: string too small.\n" );

		return( -1 );
	}
	if( internal_handle->index_build == 0 )
	{
		LIBEWF_WARNING_PRINT( "libewf_calculate_md5_hash: index was not build.\n" );

		return( -1 );
	}
	if( internal_handle->calculated_md5_hash == NULL )
	{
		data = (uint8_t *) libewf_common_alloc( internal_handle->media->chunk_size * sizeof( uint8_t ) );

		if( data == NULL )
		{
			LIBEWF_WARNING_PRINT( "libewf_calculate_md5_hash: unable to allocate data.\n" );

			return( -1 );
		}
		for( iterator = 0; iterator <= internal_handle->offset_table->last; iterator++ )
		{
			offset = iterator * internal_handle->media->chunk_size;
			count  = libewf_read_random( handle, data, internal_handle->media->chunk_size, offset );

			if( count == -1 )
			{
				LIBEWF_WARNING_PRINT( "libewf_calculate_md5_hash: unable to read chunk.\n" );

				libewf_common_free( data );

				return( -1 );
			}
			if( count > (ssize_t) INT32_MAX )
			{
				LIBEWF_WARNING_PRINT( "libewf_calculate_md5_hash: invalid count - only values below 2^32 supported.\n" );

				libewf_common_free( data );

				return( -1 );
			}
		}
		libewf_common_free( data ) ;
	}
	else
	{
		LIBEWF_VERBOSE_PRINT( "libewf_calculate_md5_hash: MD5 hash already calculated.\n" );
	}
	if( libewf_string_copy_from_digest_hash( string, length, internal_handle->calculated_md5_hash, EWF_DIGEST_HASH_SIZE_MD5 ) != 1 )
	{
		LIBEWF_WARNING_PRINT( "libewf_calculate_md5_hash: unable to set MD5 hash string.\n" );

		return( -1 );
	}
	return( 1 );
}

/* Creates a printable string of the stored md5 hash
 * Returns 1 if successful, 0 if no md5 hash is stored, -1 on error
 */
int8_t libewf_get_stored_md5_hash( LIBEWF_HANDLE *handle, LIBEWF_CHAR *string, size_t length )
{
	LIBEWF_INTERNAL_HANDLE *internal_handle = NULL;
	int8_t result                           = 0;

	if( handle == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_get_stored_md5_hash: invalid handle.\n" );

		return( -1 );
	}
	internal_handle = (LIBEWF_INTERNAL_HANDLE *) handle;

	if( internal_handle->stored_md5_hash == NULL )
	{
		LIBEWF_VERBOSE_PRINT( "libewf_get_stored_md5_hash: MD5 hash was not set.\n" );

		return( 0 );
	}
	result = libewf_string_copy_from_digest_hash( string, length, internal_handle->stored_md5_hash, EWF_DIGEST_HASH_SIZE_MD5 );

	if( result == -1 )
	{
		LIBEWF_WARNING_PRINT( "libewf_get_stored_md5_hash: unable to create MD5 hash string.\n" );
	}
	return( result );
}

/* Creates a printable string of the calculated md5 hash
 * Returns 1 if successful, 0 if no md5 hash is calculated, -1 on error
 */
int8_t libewf_get_calculated_md5_hash( LIBEWF_HANDLE *handle, LIBEWF_CHAR *string, size_t length )
{
	LIBEWF_INTERNAL_HANDLE *internal_handle = NULL;
	int8_t result                           = 0;

	if( handle == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_get_calculated_md5_hash: invalid handle.\n" );

		return( -1 );
	}
	internal_handle = (LIBEWF_INTERNAL_HANDLE *) handle;

	result = libewf_string_copy_from_digest_hash( string, length, internal_handle->calculated_md5_hash, EWF_DIGEST_HASH_SIZE_MD5 );

	if( result == -1 )
	{
		LIBEWF_WARNING_PRINT( "libewf_get_calculated_md5_hash: unable to create MD5 hash string.\n" );
	}
	return( result );
}

/* Parses the header values from the xheader, header2 or header section
 * Will parse the first available header in order mentioned above
 * Returns 1 if successful, -1 on error
 */
int8_t libewf_parse_header_values( LIBEWF_HANDLE *handle, uint8_t date_format )
{
	LIBEWF_HEADER_VALUES *header_values     = NULL;
	LIBEWF_INTERNAL_HANDLE *internal_handle = NULL;

	if( handle == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_parse_header_values: invalid handle.\n" );

		return( -1 );
	}
	internal_handle = (LIBEWF_INTERNAL_HANDLE *) handle;

	if( internal_handle->xheader != NULL )
	{
		header_values = libewf_header_values_parse_xheader( internal_handle->xheader, internal_handle->xheader_size, date_format );
	}
	if( ( header_values == NULL ) && internal_handle->header2 != NULL )
	{
		header_values = libewf_header_values_parse_header2( internal_handle->header2, internal_handle->header2_size, date_format );
	}
	if( ( header_values == NULL ) && ( internal_handle->header != NULL ) )
	{
		header_values = libewf_header_values_parse_header( internal_handle->header, internal_handle->header_size, date_format );
	}
	if( header_values == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_parse_header_values: unable to parse header(s) for values.\n" );

		return( -1 );
	}
	if( internal_handle->header_values != NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_parse_header_values: header values already set in handle - cleaning up previous ones.\n" );

		libewf_header_values_free( internal_handle->header_values );
	}
	internal_handle->header_values = header_values;

	/* The EnCase2 and EnCase3 format are the same
	 * only the acquiry software version provides insight in which version of EnCase was used
	 */
	if( ( internal_handle->format == LIBEWF_FORMAT_ENCASE2 )
	 && ( header_values->values[ LIBEWF_HEADER_VALUES_INDEX_ACQUIRY_SOFTWARE_VERSION ] != NULL )
	 && ( header_values->values[ LIBEWF_HEADER_VALUES_INDEX_ACQUIRY_SOFTWARE_VERSION ][ 0 ] == '3' ) )
 	{
		internal_handle->format = LIBEWF_FORMAT_ENCASE3;
	}
	return( 1 );
}

/* Parses the hash values from the xhash section
 * Returns 1 if successful, -1 on error
 */
int8_t libewf_parse_hash_values( LIBEWF_HANDLE *handle )
{
	LIBEWF_HASH_VALUES *hash_values         = NULL;
	LIBEWF_INTERNAL_HANDLE *internal_handle = NULL;

	if( handle == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_parse_hash_values: invalid handle.\n" );

		return( -1 );
	}
	internal_handle = (LIBEWF_INTERNAL_HANDLE *) handle;

	if( internal_handle->xhash != NULL )
	{
		hash_values = libewf_hash_values_parse_xhash( internal_handle->xhash, internal_handle->xhash_size );
	}
	if( hash_values == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_parse_hash_values: unable to parse xhash for values.\n" );

		return( -1 );
	}
	if( internal_handle->hash_values != NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_parse_hash_values: hash values already set in handle - cleaning up previous ones.\n" );

		libewf_hash_values_free( internal_handle->hash_values );
	}
	internal_handle->hash_values = hash_values;

	return( 1 );
}

/* Add an acquiry error
 * Returns 1 if successful, -1 on error
 */
int8_t libewf_add_acquiry_error( LIBEWF_HANDLE *handle, uint64_t sector, uint32_t amount_of_sectors )
{
	return( libewf_internal_handle_add_acquiry_error_sector( (LIBEWF_INTERNAL_HANDLE *) handle, sector, amount_of_sectors ) );
}

/* Set the notify values
 */
void libewf_set_notify_values( FILE *stream, uint8_t verbose )
{
	libewf_notify_set_values( stream, verbose );
}