libewf_header_values.c

sleuthit-2.09 一个磁盘的工具集

		{
			if( libewf_header_values_set_value( header_values, _S_LIBEWF_CHAR( "evidence_number" ), values[ iterator ], string_length ) != 1 )
			{
				LIBEWF_VERBOSE_PRINT( "libewf_header_values_parse_header_string: unable to set evidence number.\n" );
			}
		}
		else if( libewf_string_compare( types[ iterator ], _S_LIBEWF_CHAR( "e" ), 1 ) == 0 )
		{
			if( libewf_header_values_set_value( header_values, _S_LIBEWF_CHAR( "examiner_name" ), values[ iterator ], string_length ) != 1 )
			{
				LIBEWF_VERBOSE_PRINT( "libewf_header_values_parse_header_string: unable to set examiner name.\n" );
			}
		}
		else if( libewf_string_compare( types[ iterator ], _S_LIBEWF_CHAR( "t" ), 1 ) == 0 )
		{
			if( libewf_header_values_set_value( header_values, _S_LIBEWF_CHAR( "notes" ), values[ iterator ], string_length ) != 1 )
			{
				LIBEWF_VERBOSE_PRINT( "libewf_header_values_parse_header_string: unable to set notes.\n" );
			}
		}
		else if( libewf_string_compare( types[ iterator ], _S_LIBEWF_CHAR( "r" ), 1 ) == 0 )
		{
			if( libewf_header_values_set_value( header_values, _S_LIBEWF_CHAR( "compression_type" ), values[ iterator ], string_length ) != 1 )
			{
				LIBEWF_VERBOSE_PRINT( "libewf_header_values_parse_header_string: unable to set compression type.\n" );
			}
		}
		else
		{
			LIBEWF_WARNING_PRINT( "libewf_header_values_parse_header_string: unsupported type: %d with value: %" PRIs_EWF ".\n", types[ iterator ], values[ iterator ] );

			libewf_string_split_values_free( types, type_count );
			libewf_string_split_values_free( values, value_count );

			return( NULL );
		}
	}
	libewf_string_split_values_free( types, type_count );
	libewf_string_split_values_free( values, value_count );

	return( header_values );
}

/* Parse an EWF header for the values
 * Returns a pointer to the new instance, NULL on error
 */
LIBEWF_HEADER_VALUES *libewf_header_values_parse_header( EWF_HEADER *header, size_t size, uint8_t date_format )
{
	LIBEWF_HEADER_VALUES* header_values = NULL;
	LIBEWF_CHAR *header_string          = NULL;

	if( header == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_header_values_parse_header: invalid header.\n" );

		return( NULL );
	}
	header_string = (LIBEWF_CHAR *) libewf_common_alloc( LIBEWF_CHAR_SIZE * ( size + 1 ) );

	if( header_string == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_header_values_parse_header: unable to create header string.\n" );

		return( NULL );
	}
	if( libewf_string_copy_from_header( header_string, size, header, size ) != 1 )
	{
		LIBEWF_WARNING_PRINT( "libewf_header_values_parse_header: unable to copy header to header string.\n" );

		libewf_common_free( header_string );

		return( NULL );
	}
	header_values = libewf_header_values_parse_header_string( header_string, size, date_format );

	libewf_common_free( header_string );

	return( header_values );
}

/* Parse an EWF header for the values
 * Returns a pointer to the new instance, NULL on error
 */
LIBEWF_HEADER_VALUES *libewf_header_values_parse_header2( EWF_HEADER2 *header2, size_t size, uint8_t date_format )
{
	LIBEWF_HEADER_VALUES* header_values = NULL;
	LIBEWF_CHAR *header_string          = NULL;
	size_t header_size                  = 0;

	if( header2 == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_header_values_parse_header2: invalid header2.\n" );

		return( NULL );
	}
	header_size   = ( size - 2 ) / 2;
	header_string = (LIBEWF_CHAR *) libewf_common_alloc( LIBEWF_CHAR_SIZE * ( header_size + 1 ) );

	if( header_string == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_header_values_parse_header2: unable to create header string.\n" );

		return( NULL );
	}
	if( libewf_string_copy_from_header2( header_string, header_size, header2, size ) != 1 )
	{
		LIBEWF_WARNING_PRINT( "libewf_header_values_parse_header2: unable to copy header2 to header string.\n" );

		libewf_common_free( header_string );

		return( NULL );
	}
	header_values = libewf_header_values_parse_header_string( header_string, header_size, date_format );

	libewf_common_free( header_string );

	return( header_values );
}

/* Converts a header string into a header
 * Cleans the header string
 * Sets header length
 * Returns a pointer to the new instance, NULL on error
 */
EWF_HEADER *libewf_header_values_convert_header_string_to_header( LIBEWF_CHAR *header_string, size_t string_length, size_t *header_length )
{
	EWF_HEADER *header = NULL;

	if( header_string == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_header_values_convert_header_string_to_header: invalid header string.\n" );

		return( NULL );
	}
	if( header_length == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_header_values_convert_header_string_to_header: invalid header length.\n" );

		return( NULL );
	}
	header = (EWF_HEADER *) libewf_common_alloc( EWF_HEADER_SIZE * string_length );

	if( header == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_header_values_convert_header_string_to_header: unable to create header.\n" );

		libewf_common_free( header_string );

		return( NULL );
	}
	*header_length = string_length;

	if( libewf_string_copy_to_header( header_string, string_length, header, *header_length ) != 1 )
	{
		LIBEWF_WARNING_PRINT( "libewf_header_values_convert_header_string_to_header: unable to set header.\n" );

		libewf_common_free( header );
		libewf_common_free( header_string );

		*header_length = 0;

		return( NULL );
	}
	libewf_common_free( header_string );

	return( header );
}

/* Converts a header string into a header2
 * Cleans the header string
 * Sets header2 length
 * Returns a pointer to the new instance, NULL on error
 */
EWF_HEADER2 *libewf_header_values_convert_header_string_to_header2( LIBEWF_CHAR *header_string, size_t string_length, size_t *header2_length )
{
	EWF_HEADER2 *header2 = NULL;

	if( header_string == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_header_values_convert_header_string_to_header2: invalid header string.\n" );

		return( NULL );
	}
	if( header2_length == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_header_values_convert_header_string_to_header2: invalid header2 length.\n" );

		return( NULL );
	}
	/* Add a character for the UTF16 endian type
	 */
	*header2_length = ( string_length + 1 ) * 2;

	header2 = (EWF_HEADER2 *) libewf_common_alloc( EWF_HEADER2_SIZE * *header2_length );

	if( header2 == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_header_values_generate_header2_string_encase4: unable to create header2.\n" );

		libewf_common_free( header_string );

		*header2_length = 0;

		return( NULL );
	}
	if( libewf_string_copy_to_header2( header_string, string_length, header2, *header2_length ) != 1 )
	{
		LIBEWF_WARNING_PRINT( "libewf_header_values_generate_header2_string_encase4: unable to set header2.\n" );

		libewf_common_free( header2 );
		libewf_common_free( header_string );

		*header2_length = 0;

		return( NULL );
	}
	libewf_common_free( header_string );

	return( header2 );
}

/* Generate a header string format type 1 (original EWF, EnCase1)
 * Sets string length
 * Returns a pointer to the new instance, NULL on error
 */
LIBEWF_CHAR *libewf_header_values_generate_header_string_type1( LIBEWF_HEADER_VALUES *header_values, time_t timestamp, int8_t compression_level, LIBEWF_CHAR *header_string_head, LIBEWF_CHAR *header_string_tail, size_t *string_length )
{
	LIBEWF_CHAR *header_string    = NULL;
	LIBEWF_CHAR *case_number      = _S_LIBEWF_CHAR( "" );
	LIBEWF_CHAR *description      = _S_LIBEWF_CHAR( "" );
	LIBEWF_CHAR *examiner_name    = _S_LIBEWF_CHAR( "" );
	LIBEWF_CHAR *evidence_number  = _S_LIBEWF_CHAR( "" );
	LIBEWF_CHAR *notes            = _S_LIBEWF_CHAR( "" );
	LIBEWF_CHAR *system_date      = _S_LIBEWF_CHAR( "" );
	LIBEWF_CHAR *acquiry_date     = _S_LIBEWF_CHAR( "" );
	LIBEWF_CHAR *password_hash    = _S_LIBEWF_CHAR( "" );
	LIBEWF_CHAR *compression_type = _S_LIBEWF_CHAR( "" );

	if( header_values == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_header_values_generate_header_string_type1: invalid header values.\n" );

		return( NULL );
	}
	if( header_string_head == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_header_values_generate_header_string_type1: invalid header string head.\n" );

		return( NULL );
	}
	if( header_string_tail == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_header_values_generate_header_string_type1: invalid header string tail.\n" );

		return( NULL );
	}
	if( string_length == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_header_values_generate_header_string_type1: invalid string length.\n" );

		return( NULL );
	}
	if( ( compression_level != EWF_COMPRESSION_NONE )
	 && ( compression_level != EWF_COMPRESSION_FAST )
	 && ( compression_level != EWF_COMPRESSION_BEST ) )
	{
		LIBEWF_WARNING_PRINT( "libewf_header_values_generate_header_string_type1: compression level not supported.\n" );

		return( NULL );
	}
	*string_length = libewf_string_length( header_string_head );

	if( header_values->values[ LIBEWF_HEADER_VALUES_INDEX_CASE_NUMBER ] != NULL )
	{
		*string_length += libewf_string_length( header_values->values[ LIBEWF_HEADER_VALUES_INDEX_CASE_NUMBER ] );
		case_number     = header_values->values[ LIBEWF_HEADER_VALUES_INDEX_CASE_NUMBER ];
	}
	if( header_values->values[ LIBEWF_HEADER_VALUES_INDEX_DESCRIPTION ] != NULL )
	{
		*string_length += libewf_string_length( header_values->values[ LIBEWF_HEADER_VALUES_INDEX_DESCRIPTION ] );
		description     = header_values->values[ LIBEWF_HEADER_VALUES_INDEX_DESCRIPTION ];
	}
	if( header_values->values[ LIBEWF_HEADER_VALUES_INDEX_EXAMINER_NAME ] != NULL )
	{
		*string_length += libewf_string_length( header_values->values[ LIBEWF_HEADER_VALUES_INDEX_EXAMINER_NAME ] );
		examiner_name   = header_values->values[ LIBEWF_HEADER_VALUES_INDEX_EXAMINER_NAME ];
	}
	if( header_values->values[ LIBEWF_HEADER_VALUES_INDEX_EVIDENCE_NUMBER ] != NULL )
	{
		*string_length += libewf_string_length( header_values->values[ LIBEWF_HEADER_VALUES_INDEX_EVIDENCE_NUMBER ] );
		evidence_number = header_values->values[ LIBEWF_HEADER_VALUES_INDEX_EVIDENCE_NUMBER ];
	}
	if(  header_values->values[ LIBEWF_HEADER_VALUES_INDEX_NOTES ] != NULL )
	{
		*string_length += libewf_string_length(  header_values->values[ LIBEWF_HEADER_VALUES_INDEX_NOTES ] );
		notes           =  header_values->values[ LIBEWF_HEADER_VALUES_INDEX_NOTES ];
	}
	if( header_values->values[ LIBEWF_HEADER_VALUES_INDEX_ACQUIRY_DATE ] != NULL )
	{
		*string_length += libewf_string_length( header_values->values[ LIBEWF_HEADER_VALUES_INDEX_ACQUIRY_DATE ] );
		acquiry_date    = header_values->values[ LIBEWF_HEADER_VALUES_INDEX_ACQUIRY_DATE ];
	}
	else
	{
		acquiry_date = libewf_generate_date_header_value( timestamp );

		if( acquiry_date == NULL )
		{
			LIBEWF_WARNING_PRINT( "libewf_header_values_generate_header_string_type1: unable to generate acquiry date header value.\n" );

			acquiry_date = _S_LIBEWF_CHAR( "" );
		}
		else
		{
			*string_length += libewf_string_length( acquiry_date );
		}
	}
	if( header_values->values[ LIBEWF_HEADER_VALUES_INDEX_SYSTEM_DATE ] != NULL )
	{
		*string_length += libewf_string_length( header_values->values[ LIBEWF_HEADER_VALUES_INDEX_SYSTEM_DATE ] );
		system_date     = header_values->values[ LIBEWF_HEADER_VALUES_INDEX_SYSTEM_DATE ];
	}
	else
	{
		system_date = libewf_generate_date_header_value( timestamp );

		if( system_date == NULL )
		{
			LIBEWF_WARNING_PRINT( "libewf_header_values_generate_header_string_type1: unable to generate system date header value.\n" );

			system_date = _S_LIBEWF_CHAR( "" );
		}
		else
		{
			 *string_length += libewf_string_length( system_date );
		}
	}
	if( header_values->values[ LIBEWF_HEADER_VALUES_INDEX_PASSWORD ] != NULL )
	{
		*string_length += libewf_string_length( header_values->values[ LIBEWF_HEADER_VALUES_INDEX_PASSWORD ] );
		password_hash   = header_values->values[ LIBEWF_HEADER_VALUES_INDEX_PASSWORD ];
	}
	else
	{
		*string_length += 1;
		password_hash   = _S_LIBEWF_CHAR( "0" );
	}
	if( header_values->values[ LIBEWF_HEADER_VALUES_INDEX_COMPRESSION_TYPE ] != NULL )
	{
		*string_length  += libewf_string_length( header_values->values[ LIBEWF_HEADER_VALUES_INDEX_COMPRESSION_TYPE ] );
		compression_type = header_values->values[ LIBEWF_HEADER_VALUES_INDEX_COMPRESSION_TYPE ];
	}
	else
	{
		if( compression_level == EWF_COMPRESSION_NONE )
		{
			compression_type = (LIBEWF_CHAR *) LIBEWF_COMPRESSION_TYPE_NONE;
		}
		else if( compression_level == EWF_COMPRESSION_FAST )
		{
			compression_type = (LIBEWF_CHAR *) LIBEWF_COMPRESSION_TYPE_FAST;
		}
		else if( compression_level == EWF_COMPRESSION_BEST )
		{
			compression_type = (LIBEWF_CHAR *) LIBEWF_COMPRESSION_TYPE_BEST;
		}
		*string_length += libewf_string_length( compression_type );
	}
	*string_length += libewf_string_length( header_string_tail );

	/* allow for 10x \t and 1x \0
	 */
	*string_length += 11;

	header_string = (LIBEWF_CHAR *) libewf_common_alloc( LIBEWF_CHAR_SIZE * *string_length );

	if( header_string == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_header_values_generate_header_string_type1: unable to create header string.\n" );

		if( ( header_values->values[ LIBEWF_HEADER_VALUES_INDEX_ACQUIRY_DATE ] == NULL )
		 && ( acquiry_date != (LIBEWF_CHAR *) _S_LIBEWF_CHAR( "" ) ) )
		{
			libewf_common_free( acquiry_date );
		}