carving Namespace Reference

Namespaces
namespace	anonymous_namespace{carving.cpp}

Classes
struct	CarvingOptions

Functions
bool	run_carving (DiskReader &reader, const std::string &output_dir, const CarvingOptions &opts, std::vector< RecoveredFileRecord > &recovered, std::vector< std::string > &logs, std::string &error)

Function Documentation

run_carving()

bool carving::run_carving	(	DiskReader &	reader,
		const std::string &	output_dir,
		const CarvingOptions &	opts,
		std::vector< RecoveredFileRecord > &	recovered,
		std::vector< std::string > &	logs,
		std::string &	error )

Definition at line 954 of file carving.cpp.

                                   {
    const uint64_t disk_size = reader.size();
    if (disk_size == 0) {
        error = "Carving: disk size is zero";
        return false;
    }
    const uint64_t scan_limit = opts.max_bytes_to_scan == 0
                                 ? disk_size
                                 : std::min<uint64_t>(disk_size,
                                                      opts.max_bytes_to_scan);
 
    fs::path out_root = fs::path(output_dir) / "carved";
    {
        std::error_code ec;
        fs::create_directories(out_root, ec);
    }
 
    auto formats = build_formats();
    // Compute the longest magic to determine sliding overlap
    size_t longest_magic = 0;
    for (const auto& f : formats) {
        const size_t needed = f.magic.size() + f.magic_offset_in_file;
        if (needed > longest_magic) longest_magic = needed;
    }
    // Window size: 16 MiB main + overlap of `longest_magic` for boundary
    constexpr size_t MAIN_WINDOW = 16 * 1024 * 1024;
    const size_t overlap = longest_magic;
    std::vector<unsigned char> window(MAIN_WINDOW + overlap);
 
    size_t carved_count = 0;
    uint64_t pos = 0;
    int ident_counter = 0;
 
    auto peek_more = [&](uint64_t abs_off, unsigned char* dst,
                          size_t want) -> size_t {
        if (abs_off >= disk_size) return 0;
        const size_t can = static_cast<size_t>(
            std::min<uint64_t>(want, disk_size - abs_off));
        return reader.read_at(abs_off, dst, can) ? can : 0;
    };
 
    logs.push_back(trs("Carving: starting scan up to ") +
                   std::to_string(scan_limit / (1024 * 1024)) + " MiB");
 
    while (pos < scan_limit) {
        const size_t want = static_cast<size_t>(
            std::min<uint64_t>(window.size(), scan_limit - pos));
        if (!reader.read_at(pos, window.data(), want)) {
            logs.push_back(trs("Carving: read failure at offset ") +
                           std::to_string(pos) + trs(", skipping ahead"));
            pos += MAIN_WINDOW;
            continue;
        }
        // Scan only the main portion; the overlap will be re-scanned
        // at the start of the next window.
        const size_t scan_end = (want > overlap) ? (want - overlap) : want;
        // For the final window (we cannot read more) scan everything
        const bool last = (pos + want >= scan_limit);
        const size_t actual_end = last ? want : scan_end;
 
        for (size_t i = 0; i < actual_end; ++i) {
            for (const auto& f : formats) {
                const size_t mlen = f.magic.size();
                if (i + mlen > want) continue;
                if (std::memcmp(window.data() + i, f.magic.data(), mlen) != 0)
                    continue;
                // Magic found. Compute the file's start position.
                if (i < f.magic_offset_in_file) continue;
                const size_t file_local_start = i - f.magic_offset_in_file;
                const uint64_t file_disk_off = pos + file_local_start;
 
                // Pass the rest of the window to the detector
                const size_t window_remaining = want - file_local_start;
 
                DetectResult dr = f.detect(
                    window.data() + file_local_start,
                    window_remaining, file_disk_off,
                    opts.max_file_size,
                    const_cast<PeekMore&>(static_cast<const PeekMore&>(peek_more))
                );
 
                if (!dr.ok) continue;
                if (dr.size == 0 || dr.size > opts.max_file_size + 1) continue;
 
                // Write the carved file
                fs::path out_dir = out_root / f.name;
                {
                    std::error_code ec;
                    fs::create_directories(out_dir, ec);
                }
                std::ostringstream nm;
                nm << std::hex << file_disk_off << "_" << ident_counter
                   << "." << f.extension;
                ++ident_counter;
                fs::path out_path = out_dir / nm.str();
 
                std::ofstream out(out_path, std::ios::binary | std::ios::trunc);
                if (!out) continue;
                // Write in chunks
                constexpr size_t WBUF = 1024 * 1024;
                std::vector<unsigned char> wbuf(WBUF);
                uint64_t written = 0;
                while (written < dr.size) {
                    const size_t step = static_cast<size_t>(
                        std::min<uint64_t>(WBUF, dr.size - written));
                    if (!reader.read_at(file_disk_off + written,
                                         wbuf.data(), step)) break;
                    out.write(reinterpret_cast<const char*>(wbuf.data()),
                              static_cast<std::streamsize>(step));
                    written += step;
                }
                out.close();
 
                if (written > 0) {
                    std::string note = "carved-";
                    note += f.name;
                    if (dr.size_is_capped) note += "-capped";
                    recovered.push_back({
                        out_path.string(), "carving",
                        ("carved/" + std::string(f.name) + "/" + nm.str()),
                        written,
                        dr.size_is_capped ? "partial" : "full",
                        note});
                    ++carved_count;
                }
                // After a successful carve, advance i past the file's
                // payload (best-effort; if the user has overlapping
                // content we may miss some files but this is much faster
                // than re-scanning every byte).
                const uint64_t skip_until = file_disk_off + dr.size;
                if (skip_until > pos + i) {
                    const uint64_t skip = skip_until - (pos + i);
                    if (skip > 0 && skip < want - i) {
                        i += static_cast<size_t>(skip - 1);  // -1 because the for-loop ++
                    }
                }
                break;  // do not match this offset against more formats
            }
        }
        pos += MAIN_WINDOW;
    }
 
    {
        std::ostringstream m;
        m << trs("Carving: completed. Files recovered: ") << carved_count;
        logs.push_back(m.str());
    }
    return carved_count > 0;
}

References carving::CarvingOptions::max_bytes_to_scan, carving::CarvingOptions::max_file_size, DiskReader::read_at(), run_carving(), DiskReader::size(), and trs().

Referenced by FilesystemRecovery::recover_supported_filesystems(), and run_carving().