carving

1. Overview

The carving.cpp file implements low-level carving primitives and signature-driven extraction from raw media.

This is an implementation file. It contains executable logic for the subsystem, including parsing, I/O, validation, recovery flow, or graphical behavior declared by the corresponding interface.

Its paired source or interface file is carving.hpp.

Primary responsibilities:

  • Define carving signatures and scan windows
  • Locate candidate headers and footers
  • Validate candidate extents
  • Write carved objects with traceable metadata

2. File Identity and Scope

  • Source path: src/carving.cpp
  • Language: C++
  • File role: implementation file
  • Physical lines: 1109
  • Non-empty lines: 1022
  • SHA-256: 79422bdfa94d9d3d2fca55944c844ae394d6d3a9797bb6ba41c957e77af666b3

Declared namespaces:

  • carving

3. Dependencies

3.1 Project Headers

  • carving.hpp
  • i18n.hpp

3.2 Standard and External Headers

  • algorithm
  • array
  • cstring
  • filesystem
  • fstream
  • functional
  • sstream
  • string
  • vector

These dependencies define the file’s compile-time integration with the recovery engine, GTK interface, on-disk format decoders, operating-system services, or C++ standard library.

4. Declared Types

  • struct DetectResult.
  • struct CarverFormat.

5. Constants and Configuration Values

No preprocessor or compile-time constants were detected as top-level declarations in this file.

5.1 Operational Strings, Paths, Formats, or Commands

The following code literals are operationally relevant and may identify filesystem paths, helper commands, formats, signatures, or subsystem labels:

  • /

6. Data Members and Persistent State

No class data members are declared directly in this file, or the file primarily implements methods declared elsewhere.

7. API and Function Inventory

The following callable interfaces or definitions were detected:

  • inline uint16_t le16(const unsigned char*p) – Implements the operation identified by this API and updates or returns the associated state.
  • inline uint32_t le32(const unsigned char*p) – Implements the operation identified by this API and updates or returns the associated state.
  • inline uint32_t be32(const unsigned char*p) – Implements the operation identified by this API and updates or returns the associated state.
  • inline uint64_t be64(const unsigned char*p) – Implements the operation identified by this API and updates or returns the associated state.
  • size_t find_pattern(const unsigned char*buf,size_t buf_len,const unsigned char*pat,size_t pat_len,size_t start=0) – Inspects the source and reports matching candidates or detected metadata.
  • DetectResult detect_jpeg(const unsigned char*window,size_t window_len,uint64_t file_disk_off,uint64_t max_file_size,PeekMore&peek_more) – Inspects the source and reports matching candidates or detected metadata.
  • DetectResult detect_png(const unsigned char*window,size_t window_len,uint64_t file_disk_off,uint64_t max_file_size,PeekMore&peek_more) – Inspects the source and reports matching candidates or detected metadata.
  • DetectResult detect_gif(const unsigned char*window,size_t window_len,uint64_t file_disk_off,uint64_t max_file_size,PeekMore&peek_more) – Inspects the source and reports matching candidates or detected metadata.
  • DetectResult detect_pdf(const unsigned char*window,size_t window_len,uint64_t file_disk_off,uint64_t max_file_size,PeekMore&peek_more) – Inspects the source and reports matching candidates or detected metadata.
  • DetectResult detect_zip(const unsigned char*window,size_t window_len,uint64_t file_disk_off,uint64_t max_file_size,PeekMore&peek_more) – Inspects the source and reports matching candidates or detected metadata.
  • DetectResult detect_bmp(const unsigned char*window,size_t window_len,uint64_t,uint64_t max_file_size,PeekMore&) – Inspects the source and reports matching candidates or detected metadata.
  • DetectResult detect_mp4(const unsigned char*window,size_t window_len,uint64_t file_disk_off,uint64_t max_file_size,PeekMore&peek_more) – Inspects the source and reports matching candidates or detected metadata.
  • DetectResult detect_mp3_id3(const unsigned char*window,size_t window_len,uint64_t,uint64_t max_file_size,PeekMore&) – Inspects the source and reports matching candidates or detected metadata.
  • DetectResult detect_mp3_frame(const unsigned char*window,size_t window_len,uint64_t,uint64_t max_file_size,PeekMore&) – Inspects the source and reports matching candidates or detected metadata.
  • DetectResult detect_ogg(const unsigned char*window,size_t window_len,uint64_t file_disk_off,uint64_t max_file_size,PeekMore&peek_more) – Inspects the source and reports matching candidates or detected metadata.
  • DetectResult detect_tiff(const unsigned char*window,size_t window_len,uint64_t,uint64_t max_file_size,PeekMore&) – Inspects the source and reports matching candidates or detected metadata.
  • DetectResult detect_ole(const unsigned char*window,size_t window_len,uint64_t,uint64_t max_file_size,PeekMore&) – Inspects the source and reports matching candidates or detected metadata.
  • DetectResult detect_riff(const unsigned char*window,size_t window_len,uint64_t,uint64_t max_file_size,PeekMore&) – Inspects the source and reports matching candidates or detected metadata.
  • DetectResult detect_mkv(const unsigned char*window,size_t window_len,uint64_t,uint64_t max_file_size,PeekMore&) – Inspects the source and reports matching candidates or detected metadata.
  • DetectResult detect_sqlite(const unsigned char*window,size_t window_len,uint64_t,uint64_t max_file_size,PeekMore&) – Inspects the source and reports matching candidates or detected metadata.
  • std::vector<CarverFormat> build_formats() – Constructs the requested object, data structure or user-interface component.
  • bool run_carving(DiskReader&reader,const std::string&output_dir,const CarvingOptions&opts,std::vector<RecoveredFileRecord>&recovered,std::vector<std::string>&logs,std::string&error) – Implements the operation identified by this API and updates or returns the associated state.

8. Operational Flow

The subsystem represented by this file normally participates in the following flow:

  1. Define carving signatures and scan windows.
  2. Locate candidate headers and footers.
  3. Validate candidate extents.
  4. Write carved objects with traceable metadata.
  5. Expose or execute the detected APIs: le16, le32, be32, be64, find_pattern, detect_jpeg, detect_png, detect_gif, detect_pdf, detect_zip, detect_bmp, detect_mp4, detect_mp3_id3, detect_mp3_frame, detect_ogg, detect_tiff, detect_ole, detect_riff and additional helpers.
  6. Return explicit results, progress data, recovered records, or diagnostics to the calling layer.

9. Validation and Error Handling

  • Errors are propagated through Boolean results, error strings, logs, exceptions, or status records depending on the API.
  • Byte offsets, sizes and lengths must be validated before arithmetic and before every read to avoid overflow and out-of-bounds access.
  • On-disk structures are accepted only after validating signatures, magic values and structural constraints.
  • Input and output paths require existence checks, permission handling and safe destination construction.
  • The implementation contains explicit failure-catching paths and should retain the original diagnostic context.

10. Runtime, Concurrency, and Resource Management

  • I/O: filesystem and raw-source operations can fail partially and must preserve exact byte counts and diagnostic context.
  • Error handling: explicit error, exception or optional-result paths are present and form part of the file contract.
  • File descriptors and streams must be closed on success, cancellation and error paths.
  • Temporary loop devices, mappings and mounts require deterministic reverse-order cleanup.

11. Security and Data-Recovery Considerations

  • Recovery code should prefer read-only source access and avoid writing to the original damaged medium.
  • Raw devices and image files are treated as untrusted binary input; every offset and length must remain bounded by the source size.
  • Recovered names and destination paths must be sanitized to prevent directory traversal and accidental overwrite outside the selected export directory.

12. Implementation Considerations

  • The implementation should remain aligned with declarations in the paired header and preserve documented return-value semantics.
  • The file is large and combines multiple parsing or recovery stages; refactoring should preserve byte-level behavior and regression coverage.
  • Binary decoding uses low-level memory operations or casts; alignment, endianness and packed-structure assumptions require careful review.
  • Large-device arithmetic uses 64-bit values; additions and multiplications should be checked before use as offsets or allocation sizes.
  • Filesystem operations can cross trust boundaries and should use normalized, contained destination paths.

13. Integration with the Recovery Pipeline

  • The file belongs to the extraction layer and consumes scan candidates or validated filesystem metadata.
  • Recovered output is represented through shared models and returned to the exporter or UI.
  • Partial recovery must be reported explicitly rather than silently treated as complete.

14. Licensing and Provenance

No explicit copyright or software-license statement was detected in the opening section of this individual file. Distribution terms should therefore be verified against the project-level license and repository metadata.

The SHA-256 value in this document can be used to associate the generated documentation with the exact source version analyzed.

Published on:
Last updated on: