mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-15 01:07:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'scalpel-carver' of https://github.com/tmciver-basis/autopsy into scalpel-carver

Browse Source
This commit is contained in:
adam-m 2013-04-29 19:57:39 -04:00
commit dd284a896e
1 changed files with 16 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
ScalpelCarver/src/org/sleuthkit/autopsy/scalpel/ScalpelCarverIngestModule.java
View File

@ -137,9 +137,18 @@ public class ScalpelCarverIngestModule implements IngestModuleAbstractFile {
// java.util.logging.Logger.getLogger(ScalpelCarverIngestModule.class.getName()).log(Level.SEVERE, null, ex);
// return ProcessResult.OK;
// }
// output = new ArrayList<CarvedFileMeta>();
// output.add(new CarvedFileMeta("carved-from-" + abstractFile.getId() + ".txt", 0, abstractFile.getSize()));
// get the image's size
long imageSize = Long.MAX_VALUE;
try {
imageSize = abstractFile.getImage().getSize();
} catch (TskCoreException ex) {
logger.log(Level.SEVERE, "Could not obtain the image's size.");
}
// add a carved file to the DB for each file that scalpel carved
SleuthkitCase db = Case.getCurrentCase().getSleuthkitCase();
@ -158,6 +167,12 @@ public class ScalpelCarverIngestModule implements IngestModuleAbstractFile {
// get the size of the carved file
long size = carvedFileMeta.getByteLength();
// hack to fix the size of carved files that run to the end of the image
long endByte = byteOffset + size - 1;
if (endByte >= imageSize) {
size = imageSize - byteOffset;
}
// create the list of TskFileRange objects
List<TskFileRange> data = new ArrayList<TskFileRange>();
data.add(new TskFileRange(byteOffset, size, 0));