libewf_internal_handle.c

sleuthit-2.09 一个磁盘的工具集

		return( -1 );
	}
        /* The acquiry date, system date values and compression type will be generated automatically when set to NULL
         */
	return( 1 );
}

/* Create the header strings from the header values
 * Returns 1 on success, -1 on error
 */
int8_t libewf_internal_handle_create_headers( LIBEWF_INTERNAL_HANDLE *internal_handle, LIBEWF_HEADER_VALUES *header_values )
{
	time_t timestamp = time( NULL );

	if( internal_handle == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_internal_handle_create_headers: invalid handle.\n" );

		return( -1 );
	}
	if( internal_handle->format == LIBEWF_FORMAT_EWF )
	{
		internal_handle->header = libewf_header_values_generate_header_string_ewf( header_values, timestamp, internal_handle->compression_level, &internal_handle->header_size );

		if( internal_handle->header == NULL )
		{
			LIBEWF_WARNING_PRINT( "libewf_internal_handle_create_headers: unable to create header values.\n" );

			return( -1 );
		}
	}
	else if( internal_handle->format == LIBEWF_FORMAT_ENCASE1 )
	{
		internal_handle->header = libewf_header_values_generate_header_string_encase1( header_values, timestamp, internal_handle->compression_level, &internal_handle->header_size );

		if( internal_handle->header == NULL )
		{
			LIBEWF_WARNING_PRINT( "libewf_internal_handle_create_headers: unable to create header values.\n" );

			return( -1 );
		}
	}
	else if( ( internal_handle->format == LIBEWF_FORMAT_ENCASE2 )
	 || ( internal_handle->format == LIBEWF_FORMAT_ENCASE3 ) )
	{
		internal_handle->header = libewf_header_values_generate_header_string_encase2( header_values, timestamp, internal_handle->compression_level, &internal_handle->header_size );

		if( internal_handle->header == NULL )
		{
			LIBEWF_WARNING_PRINT( "libewf_internal_handle_create_headers: unable to create header values.\n" );

			return( -1 );
		}
	}
	else if( ( internal_handle->format == LIBEWF_FORMAT_FTK )
	 || ( internal_handle->format == LIBEWF_FORMAT_SMART ) )
	{
		internal_handle->header = libewf_header_values_generate_header_string_ftk( header_values, timestamp, internal_handle->compression_level, &internal_handle->header_size );

		if( internal_handle->header == NULL )
		{
			LIBEWF_WARNING_PRINT( "libewf_internal_handle_create_headers: unable to create header values.\n" );

			return( -1 );
		}
	}
	else if( internal_handle->format == LIBEWF_FORMAT_ENCASE4 )
	{
		internal_handle->header = libewf_header_values_generate_header_string_encase4( header_values, timestamp, &internal_handle->header_size );

		if( internal_handle->header == NULL )
		{
			LIBEWF_WARNING_PRINT( "libewf_internal_handle_create_headers: unable to create header values.\n" );

			return( -1 );
		}
		internal_handle->header2 = libewf_header_values_generate_header2_string_encase4( header_values, timestamp, &internal_handle->header2_size );

		if( internal_handle->header2 == NULL )
		{
			LIBEWF_WARNING_PRINT( "libewf_internal_handle_create_headers: unable to create header2 values.\n" );

			libewf_common_free( internal_handle->header );

			internal_handle->header      = NULL;
			internal_handle->header_size = 0;

			return( -1 );
		}
	}
	else if( internal_handle->format == LIBEWF_FORMAT_ENCASE5 )
	{
		internal_handle->header = libewf_header_values_generate_header_string_encase4( header_values, timestamp, &internal_handle->header_size );

		if( internal_handle->header == NULL )
		{
			LIBEWF_WARNING_PRINT( "libewf_internal_handle_create_headers: unable to create header values.\n" );

			return( -1 );
		}
		internal_handle->header2 = libewf_header_values_generate_header2_string_encase5( header_values, timestamp, &internal_handle->header2_size );

		if( internal_handle->header2 == NULL )
		{
			LIBEWF_WARNING_PRINT( "libewf_internal_handle_create_headers: unable to create header2 values.\n" );

			libewf_common_free( internal_handle->header );

			internal_handle->header      = NULL;
			internal_handle->header_size = 0;

			return( -1 );
		}
	}
	else if( internal_handle->format == LIBEWF_FORMAT_ENCASE6 )
	{
		internal_handle->header = libewf_header_values_generate_header_string_encase4( header_values, timestamp, &internal_handle->header_size );

		if( internal_handle->header == NULL )
		{
			LIBEWF_WARNING_PRINT( "libewf_internal_handle_create_headers: unable to create header values.\n" );

			return( -1 );
		}
		internal_handle->header2 = libewf_header_values_generate_header2_string_encase6( header_values, timestamp, &internal_handle->header2_size );

		if( internal_handle->header2 == NULL )
		{
			LIBEWF_WARNING_PRINT( "libewf_internal_handle_create_headers: unable to create header2 values.\n" );

			libewf_common_free( internal_handle->header );

			internal_handle->header      = NULL;
			internal_handle->header_size = 0;

			return( -1 );
		}
	}
	else if( ( internal_handle->format == LIBEWF_FORMAT_LINEN5 )
	 || ( internal_handle->format == LIBEWF_FORMAT_LINEN6 ) )
	{
		internal_handle->header = libewf_header_values_generate_header_string_encase5_linen( header_values, timestamp, &internal_handle->header_size );

		if( internal_handle->header == NULL )
		{
			LIBEWF_WARNING_PRINT( "libewf_internal_handle_create_headers: unable to create header values.\n" );

			return( -1 );
		}
	}
	else if( internal_handle->format == LIBEWF_FORMAT_EWFX )
	{
		internal_handle->header = libewf_header_values_generate_header_string_ewfx( header_values, timestamp, &internal_handle->header_size );

		if( internal_handle->header == NULL )
		{
			LIBEWF_WARNING_PRINT( "libewf_internal_handle_create_headers: unable to create header values.\n" );

			return( -1 );
		}
		internal_handle->header2 = libewf_header_values_generate_header2_string_ewfx( header_values, timestamp, &internal_handle->header2_size );

		if( internal_handle->header2 == NULL )
		{
			LIBEWF_WARNING_PRINT( "libewf_internal_handle_create_headers: unable to create header2 values.\n" );

			libewf_common_free( internal_handle->header );

			internal_handle->header      = NULL;
			internal_handle->header_size = 0;

			return( -1 );
		}
		internal_handle->xheader = libewf_header_values_generate_xheader_string_ewfx( header_values, timestamp, &internal_handle->xheader_size );

		if( internal_handle->xheader == NULL )
		{
			LIBEWF_WARNING_PRINT( "libewf_internal_handle_create_headers: unable to create xheader values.\n" );

			libewf_common_free( internal_handle->header );
			libewf_common_free( internal_handle->header2 );

			internal_handle->header       = NULL;
			internal_handle->header_size  = 0;
			internal_handle->header2      = NULL;
			internal_handle->header2_size = 0;

			return( -1 );
		}
	}
	return( 1 );
}

/* Check if the read values have been initialized
 * Returns 0 if not initialized, 1 if set, or -1 on error
 */
int8_t libewf_internal_handle_read_is_initialized( LIBEWF_INTERNAL_HANDLE *internal_handle )
{
	if( internal_handle == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_internal_handle_read_is_initialized: invalid handle.\n" );

		return( -1 );
	}
	if( internal_handle->read == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_internal_handle_read_is_initialized: invalid handle - missing subhandle read.\n" );

		return( -1 );
	}
	return( internal_handle->read->values_initialized );
}

/* Initializes the read values
 * Returns 1 if successful, -1 on error
 */
int8_t libewf_internal_handle_read_initialize( LIBEWF_INTERNAL_HANDLE *internal_handle )
{
	if( internal_handle == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_internal_handle_read_initialize: invalid handle.\n" );

		return( -1 );
	}
	if( internal_handle->read == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_internal_handle_read_initialize: invalid handle - missing subhandle read.\n" );

		return( -1 );
	}
	/* Initialize the MD5 context
	 */
	if( libewf_md5_initialize( &internal_handle->md5_context ) != 1 )
	{
		LIBEWF_WARNING_PRINT( "libewf_internal_handle_read_initialize: unable to initialize MD5 context.\n" );

		return( -1 );
	}
	return( 1 );
}

/* Check if the write values have been initialized
 * Returns 0 if not initialized, 1 if set, or -1 on error
 */
int8_t libewf_internal_handle_write_is_initialized( LIBEWF_INTERNAL_HANDLE *internal_handle )
{
	if( internal_handle == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_internal_handle_write_is_initialized: invalid handle.\n" );

		return( -1 );
	}
	if( internal_handle->write == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_internal_handle_write_is_initialized: invalid handle - missing subhandle write.\n" );

		return( -1 );
	}
	return( internal_handle->write->values_initialized );
}

/* Initializes the write values
 * Returns 1 if successful, -1 on error
 */
int8_t libewf_internal_handle_write_initialize( LIBEWF_INTERNAL_HANDLE *internal_handle )
{
	int64_t required_amount_of_segments = 0;
	int64_t amount_of_chunks            = 0;
	int64_t amount_of_sectors           = 0;
	uint64_t maximum_input_file_size    = 0;

	if( internal_handle == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_internal_handle_write_initialize: invalid handle.\n" );

		return( -1 );
	}
	if( internal_handle->chunk_cache == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_internal_handle_write_initialize: invalid handle - missing chunk cache.\n" );

		return( -1 );
	}
	if( internal_handle->media == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_internal_handle_write_initialize: invalid handle - missing subhandle media.\n" );

		return( -1 );
	}
	if( internal_handle->write == NULL )
	{
		LIBEWF_WARNING_PRINT( "libewf_internal_handle_write_initialize: invalid handle - missing subhandle write.\n" );

		return( -1 );
	}
	if( internal_handle->write->values_initialized != 0 )
	{
		LIBEWF_WARNING_PRINT( "libewf_internal_handle_write_initialize: write values were initialized and cannot be initialized anymore.\n" );

		return( -1 );
	}
	if( internal_handle->media->chunk_size == 0 )
	{
		LIBEWF_WARNING_PRINT( "libewf_internal_handle_write_initialize: the media chunk size cannot be zero - using default media values.\n" );

		internal_handle->media->sectors_per_chunk = 64;
		internal_handle->media->bytes_per_sector  = 512;
		internal_handle->media->chunk_size        = EWF_MINIMUM_CHUNK_SIZE;
	}
	if( internal_handle->media->chunk_size > (uint32_t) INT32_MAX )
	{
		LIBEWF_WARNING_PRINT( "libewf_internal_handle_write_initialize: invalid media chunk size only values below 2^32 are supported.\n" );

		return( -1 );
	}
	if( internal_handle->media->bytes_per_sector > (uint32_t) INT32_MAX )
	{
		LIBEWF_WARNING_PRINT( "libewf_internal_handle_write_initialize: invalid bytes per sector only values below 2^32 are supported.\n" );

		return( -1 );
	}
	if( internal_handle->write->segment_file_size == 0 )
	{
		LIBEWF_WARNING_PRINT( "libewf_internal_handle_write_initialize: the segment file size cannot be zero - using default value.\n" );

		internal_handle->write->segment_file_size = LIBEWF_DEFAULT_SEGMENT_FILE_SIZE;
	}
	if( internal_handle->write->segment_file_size > (uint32_t) INT32_MAX )
	{
		LIBEWF_WARNING_PRINT( "libewf_internal_handle_write_initialize: invalid segment file size only values below 2^32 are supported.\n" );

		return( -1 );
	}
	if( ( internal_handle->compression_level != EWF_COMPRESSION_NONE ) && ( internal_handle->compression_level != EWF_COMPRESSION_FAST )
	 && ( internal_handle->compression_level != EWF_COMPRESSION_BEST ) )
	{
		LIBEWF_WARNING_PRINT( "libewf_internal_handle_write_initialize: unsupported compression level - using default.\n" );

		internal_handle->compression_level           = EWF_COMPRESSION_NONE;
		internal_handle->write->compress_empty_block = 1;
	}
	/* Check if the input file size does not exceed the maximum input file size
	 */
	maximum_input_file_size = (uint64_t) internal_handle->media->chunk_size * (uint64_t) UINT32_MAX;

	if( internal_handle->write->input_write_size > maximum_input_file_size )
	{
		LIBEWF_WARNING_PRINT( "libewf_internal_handle_write_initialize: input write size cannot be larger than size: %" PRIu64 " with a chunk size of: %" PRIu32 ".\n", maximum_input_file_size, internal_handle->media->chunk_size );

		return( -1 );
	}
	if( internal_handle->write->input_write_size > (uint64_t) INT64_MAX )
	{
		LIBEWF_WARNING_PRINT( "libewf_internal_handle_write_initialize: invalid input write size only values below 2^64 are supported.\n" );

		return( -1 );
	}
	/* Determine the EWF file format
	 */
	if( internal_handle->format == LIBEWF_FORMAT_LVF )
	{
		LIBEWF_WARNING_PRINT( "libewf_internal_handle_write_initialize: writing format LVF currently not supported.\n" );

		return( -1 );
	}
	if( ( internal_handle->format != LIBEWF_FORMAT_ENCASE1 )
	 && ( internal_handle->format != LIBEWF_FORMAT_ENCASE2 )
	 && ( internal_handle->format != LIBEWF_FORMAT_ENCASE3 )
	 && ( internal_handle->format != LIBEWF_FORMAT_ENCASE4 )
	 && ( internal_handle->format != LIBEWF_FORMAT_ENCASE5 )
	 && ( internal_handle->format != LIBEWF_FORMAT_ENCASE6 )
	 && ( internal_handle->format != LIBEWF_FORMAT_LINEN5 )
	 && ( internal_handle->format != LIBEWF_FORMAT_LINEN6 )
	 && ( internal_handle->format != LIBEWF_FORMAT_SMART )
	 && ( internal_handle->format != LIBEWF_FORMAT_FTK )
	 && ( internal_handle->format != LIBEWF_FORMAT_LVF )
	 && ( internal_handle->format != LIBEWF_FORMAT_EWF )
	 && ( internal_handle->format != LIBEWF_FORMAT_EWFX ) )
	{
		LIBEWF_WARNING_PRINT( "libewf_internal_handle_write_initialize: unsupported format - using default.\n" );

		internal_handle->format = LIBEWF_FORMAT_ENCASE5;
	}
	if( ( internal_handle->format == LIBEWF_FORMAT_EWF )
	 || ( internal_handle->format == LIBEWF_FORMAT_SMART ) )
	{
		internal_handle->ewf_format = EWF_FORMAT_S01;
	}
	else if( internal_handle->format == LIBEWF_FORMAT_LVF )
	{
		internal_handle->ewf_format = EWF_FORMAT_L01;
	}
	else
	{
		internal_handle->ewf_format = EWF_FORMAT_E01;
	}
	if( ( internal_handle->format == LIBEWF_FORMAT_ENCASE6 )
	 || ( internal_handle->format == LIBEWF_FORMAT_LINEN6 )
	 || ( internal_handle->format == LIBEWF_FORMAT_EWFX ) )
	{
		internal_handle->write->unrestrict_offset_amount = 1;
	}
	/* Determine the maximum amount of segments allowed to write
	 */
	internal_handle->write->maximum_amount_of_segments = libewf_internal_handle_get_write_maximum_amount_of_segments( internal_handle );

	if( internal_handle->write->maximum_amount_of_s