From 79a0e883086d403824ddc77a8115c2fdbc807ce7 Mon Sep 17 00:00:00 2001 From: Tim McIver Date: Mon, 29 Apr 2013 16:51:30 -0400 Subject: [PATCH] Added code to correct the reported size of carved files that run to the end of the image. There appears to be an error from Scalpel for the size of these files. --- .../scalpel/ScalpelCarverIngestModule.java | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/ScalpelCarver/src/org/sleuthkit/autopsy/scalpel/ScalpelCarverIngestModule.java b/ScalpelCarver/src/org/sleuthkit/autopsy/scalpel/ScalpelCarverIngestModule.java index 771bd1b94a..2bbb5cd56f 100644 --- a/ScalpelCarver/src/org/sleuthkit/autopsy/scalpel/ScalpelCarverIngestModule.java +++ b/ScalpelCarver/src/org/sleuthkit/autopsy/scalpel/ScalpelCarverIngestModule.java @@ -137,9 +137,18 @@ public class ScalpelCarverIngestModule implements IngestModuleAbstractFile { // java.util.logging.Logger.getLogger(ScalpelCarverIngestModule.class.getName()).log(Level.SEVERE, null, ex); // return ProcessResult.OK; // } - + // output = new ArrayList(); // output.add(new CarvedFileMeta("carved-from-" + abstractFile.getId() + ".txt", 0, abstractFile.getSize())); + + // get the image's size + long imageSize = Long.MAX_VALUE; + try { + + imageSize = abstractFile.getImage().getSize(); + } catch (TskCoreException ex) { + logger.log(Level.SEVERE, "Could not obtain the image's size."); + } // add a carved file to the DB for each file that scalpel carved SleuthkitCase db = Case.getCurrentCase().getSleuthkitCase(); @@ -158,6 +167,12 @@ public class ScalpelCarverIngestModule implements IngestModuleAbstractFile { // get the size of the carved file long size = carvedFileMeta.getByteLength(); + // hack to fix the size of carved files that run to the end of the image + long endByte = byteOffset + size - 1; + if (endByte >= imageSize) { + size = imageSize - byteOffset; + } + // create the list of TskFileRange objects List data = new ArrayList(); data.add(new TskFileRange(byteOffset, size, 0));