mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-12 16:06:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Changed code to use TSK ranges for unallocated file boundary calculations

Browse Source
This commit is contained in:
Eugene Livis 2015-02-11 21:32:41 -05:00
parent f50179ab90
commit 32b2588f84
1 changed files with 8 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
Core/src/org/sleuthkit/autopsy/modules/photoreccarver/PhotoRecCarverOutputParser.java
View File

@ -93,6 +93,10 @@ class PhotoRecCarverOutputParser {
// create and initialize the list to put into the database
List<CarvedFileContainer> carvedFileContainer = new ArrayList<>();
List<TskFileRange> ranges = af.getRanges();
TskFileRange lastRange = ranges.get(ranges.size() - 1);
long imageByteEnd = lastRange.getByteStart() + lastRange.getByteLen();
for (int fileIndex = 0; fileIndex < numberOfFiles; ++fileIndex) {
entry = (Element) fileObjects.item(fileIndex);
@ -109,21 +113,19 @@ class PhotoRecCarverOutputParser {
List<TskFileRange> tskRanges = new ArrayList<>();
for (int rangeIndex = 0; rangeIndex < fileRanges.getLength(); ++rangeIndex) {
Long img_offset = Long.parseLong(((Element) fileRanges.item(rangeIndex)).getAttribute("img_offset")); //NON-NLS
Long len = Long.parseLong(((Element) fileRanges.item(rangeIndex)).getAttribute("len")); //NON-NLS
// Verify PhotoRec's output
long imageByteStart = af.convertToImgOffset(0);
long imageByteEnd = imageByteStart + af.getSize();
long fileByteStart = af.convertToImgOffset(img_offset);
long fileByteEnd = fileByteStart + len;
if (fileByteStart < imageByteStart || fileByteStart >= imageByteEnd) {
if (fileByteStart == -1) {
// This better never happen... Data for this file is corrupted. Skip it.
logger.log(Level.INFO, "Error while parsing PhotoRec output for file {0}", fileName); //NON-NLS
continue;
}
long fileByteEnd = fileByteStart + len;
if (fileByteEnd > imageByteEnd) {
long overshoot = fileByteEnd - imageByteEnd;
if (fileSize > overshoot) {