Classes
struct	Pattern

Functions
std::vector< Pattern >	patterns ()
bool	starts_with_at (const std::vector< unsigned char > &buf, size_t pos, const std::vector< unsigned char > &pat)
bool	looks_like_mp4 (const std::vector< unsigned char > &buf, size_t pos)
bool	copy_range (DiskReader &reader, uint64_t offset, uint64_t size, const fs::path &out_path, std::string &error)
bool	carve_one_range (DiskReader &reader, uint64_t range_offset, uint64_t range_size, const std::vector< Pattern > &pats, const std::string &output_dir, std::vector< CarvedFile > &carved, std::vector< std::string > &logs, std::string &error)

Variables
constexpr uint64_t	MiB = 1024ull * 1024ull
constexpr size_t	WINDOW = 2 * 1024 * 1024
constexpr uint64_t	MAX_FILE_SIZE = 128ull * 1024ull * 1024ull

Function Documentation

◆ carve_one_range()

bool anonymous_namespace{file_carver.cpp}::carve_one_range	(	DiskReader &	reader,
		uint64_t	range_offset,
		uint64_t	range_size,
		const std::vector< Pattern > &	pats,
		const std::string &	output_dir,
		std::vector< CarvedFile > &	carved,
		std::vector< std::string > &	logs,
		std::string &	error )

Definition at line 76 of file file_carver.cpp.

                                       {
    if (range_size == 0) return true;
 
    const uint64_t file_size = reader.size();
    if (range_offset >= file_size) return true;
    const uint64_t range_end = std::min<uint64_t>(file_size, range_offset + range_size);
 
    std::vector<unsigned char> buffer(WINDOW);
 
    uint64_t base = range_offset;
    while (base < range_end) {
        const size_t to_read = static_cast<size_t>(std::min<uint64_t>(WINDOW, range_end - base));
        if (!reader.read_at(base, buffer.data(), to_read)) {
            error = trs("Read error during file carving");
            return false;
        }
        std::vector<unsigned char> chunk(buffer.begin(), buffer.begin() + static_cast<std::ptrdiff_t>(to_read));
 
        for (size_t i = 0; i < chunk.size(); ++i) {
            for (const auto& p : pats) {
                bool match = false;
                if (std::string(p.type) == "MP4") {
                    match = looks_like_mp4(chunk, i);
                } else {
                    match = starts_with_at(chunk, i, p.header);
                }
                if (!match) continue;
 
                const uint64_t abs_off = base + i;
                if (abs_off >= range_end) continue;
                if (!carved.empty() && abs_off < carved.back().offset + carved.back().size) {
                    continue;
                }
 
                uint64_t found_size = 0;
                if (p.footer_required) {
                    const uint64_t search_limit = std::min<uint64_t>(range_end - abs_off, MAX_FILE_SIZE);
                    std::vector<unsigned char> probe(static_cast<size_t>(search_limit));
                    if (!reader.read_at(abs_off, probe.data(), probe.size())) continue;
                    for (size_t j = p.header.size(); j + p.footer.size() <= probe.size(); ++j) {
                        if (std::equal(p.footer.begin(), p.footer.end(), probe.begin() + static_cast<std::ptrdiff_t>(j))) {
                            found_size = j + p.footer.size();
                            break;
                        }
                    }
                    if (found_size == 0) continue;
                } else {
                    found_size = std::min<uint64_t>(16ull * MiB, range_end - abs_off);
                }
 
                std::ostringstream name;
                name << std::string(p.type) << '_' << std::setw(12) << std::setfill('0') << abs_off << p.ext;
                fs::path out_path = fs::path(output_dir) / name.str();
                std::string copy_error;
                if (!copy_range(reader, abs_off, found_size, out_path, copy_error)) {
                    error = copy_error;
                    return false;
                }
 
                carved.push_back(CarvedFile{
                    p.type,
                    p.ext,
                    abs_off,
                    found_size,
                    p.footer_required ? 0.72 : 0.45,
                    p.footer_required ? trs("Recovered by header/footer carving") : trs("Recovered by header-based carving"),
                    out_path.string()
                });
                logs.push_back(trs("Recovered carved file:") + std::string(" ") + out_path.string());
                break;
            }
        }
        if (base + to_read >= range_end) break;
        base += MiB;
    }
 
    return true;
}

References carve_one_range(), copy_range(), looks_like_mp4(), MAX_FILE_SIZE, MiB, DiskReader::read_at(), DiskReader::size(), starts_with_at(), trs(), and WINDOW.

Referenced by carve_one_range().

◆ copy_range()

bool anonymous_namespace{file_carver.cpp}::copy_range	(	DiskReader &	reader,
		uint64_t	offset,
		uint64_t	size,
		const fs::path &	out_path,
		std::string &	error )

Definition at line 49 of file file_carver.cpp.

                                                                                                              {
    std::ofstream out(out_path, std::ios::binary);
    if (!out) {
        error = trs("Unable to create output file") + std::string(": ") + out_path.string();
        return false;
    }
 
    std::vector<unsigned char> buffer(1024 * 1024);
    uint64_t remaining = size;
    uint64_t cursor = offset;
    while (remaining > 0) {
        const size_t chunk = static_cast<size_t>(std::min<uint64_t>(buffer.size(), remaining));
        if (!reader.read_at(cursor, buffer.data(), chunk)) {
            error = trs("Read error while exporting carved file");
            return false;
        }
        out.write(reinterpret_cast<const char*>(buffer.data()), static_cast<std::streamsize>(chunk));
        if (!out) {
            error = trs("Write error while exporting carved file");
            return false;
        }
        cursor += chunk;
        remaining -= chunk;
    }
    return true;
}

References copy_range(), DiskReader::read_at(), and trs().

Referenced by carve_one_range(), and copy_range().

◆ looks_like_mp4()

bool anonymous_namespace{file_carver.cpp}::looks_like_mp4	(	const std::vector< unsigned char > &	buf,
		size_t	pos )

Definition at line 44 of file file_carver.cpp.

                                                                     {
    if (pos + 8 > buf.size()) return false;
    return buf[pos+4] == 'f' && buf[pos+5] == 't' && buf[pos+6] == 'y' && buf[pos+7] == 'p';
}

References looks_like_mp4().

Referenced by carve_one_range(), and looks_like_mp4().

◆ patterns()

std::vector< Pattern > anonymous_namespace{file_carver.cpp}::patterns ( )

Definition at line 28 of file file_carver.cpp.

                              {
    return {
        {"JPEG", ".jpg", {0xFF,0xD8,0xFF}, {0xFF,0xD9}, true},
        {"PNG", ".png", {0x89,0x50,0x4E,0x47,0x0D,0x0A,0x1A,0x0A}, {0x49,0x45,0x4E,0x44,0xAE,0x42,0x60,0x82}, true},
        {"PDF", ".pdf", {0x25,0x50,0x44,0x46,0x2D}, {0x25,0x25,0x45,0x4F,0x46}, true},
        {"ZIP", ".zip", {0x50,0x4B,0x03,0x04}, {0x50,0x4B,0x05,0x06}, true},
        {"GIF", ".gif", {0x47,0x49,0x46,0x38}, {0x3B}, true},
        {"MP4", ".mp4", {0x00,0x00,0x00}, {'f','t','y','p'}, false}
    };
}

References patterns().

Referenced by patterns().

◆ starts_with_at()

bool anonymous_namespace{file_carver.cpp}::starts_with_at	(	const std::vector< unsigned char > &	buf,
		size_t	pos,
		const std::vector< unsigned char > &	pat )

Definition at line 39 of file file_carver.cpp.

                                                                                                          {
    if (pos + pat.size() > buf.size()) return false;
    return std::equal(pat.begin(), pat.end(), buf.begin() + static_cast<std::ptrdiff_t>(pos));
}