file_carver.cpp

Go to the documentation of this file.

#include "file_carver.hpp"
#include "i18n.hpp"
 
#include <algorithm>
#include <array>
#include <filesystem>
#include <fstream>
#include <iomanip>
#include <sstream>
#include <utility>
#include <vector>
 
namespace fs = std::filesystem;
 
namespace {
constexpr uint64_t MiB = 1024ull * 1024ull;
constexpr size_t WINDOW = 2 * 1024 * 1024;
constexpr uint64_t MAX_FILE_SIZE = 128ull * 1024ull * 1024ull;
 
struct Pattern {
    const char* type;
    const char* ext;
    std::vector<unsigned char> header;
    std::vector<unsigned char> footer;
    bool footer_required {true};
};
 
std::vector<Pattern> patterns() {
    return {
        {"JPEG", ".jpg", {0xFF,0xD8,0xFF}, {0xFF,0xD9}, true},
        {"PNG", ".png", {0x89,0x50,0x4E,0x47,0x0D,0x0A,0x1A,0x0A}, {0x49,0x45,0x4E,0x44,0xAE,0x42,0x60,0x82}, true},
        {"PDF", ".pdf", {0x25,0x50,0x44,0x46,0x2D}, {0x25,0x25,0x45,0x4F,0x46}, true},
        {"ZIP", ".zip", {0x50,0x4B,0x03,0x04}, {0x50,0x4B,0x05,0x06}, true},
        {"GIF", ".gif", {0x47,0x49,0x46,0x38}, {0x3B}, true},
        {"MP4", ".mp4", {0x00,0x00,0x00}, {'f','t','y','p'}, false}
    };
}
 
bool starts_with_at(const std::vector<unsigned char>& buf, size_t pos, const std::vector<unsigned char>& pat) {
    if (pos + pat.size() > buf.size()) return false;
    return std::equal(pat.begin(), pat.end(), buf.begin() + static_cast<std::ptrdiff_t>(pos));
}
 
bool looks_like_mp4(const std::vector<unsigned char>& buf, size_t pos) {
    if (pos + 8 > buf.size()) return false;
    return buf[pos+4] == 'f' && buf[pos+5] == 't' && buf[pos+6] == 'y' && buf[pos+7] == 'p';
}
 
bool copy_range(DiskReader& reader, uint64_t offset, uint64_t size, const fs::path& out_path, std::string& error) {
    std::ofstream out(out_path, std::ios::binary);
    if (!out) {
        error = trs("Unable to create output file") + std::string(": ") + out_path.string();
        return false;
    }
 
    std::vector<unsigned char> buffer(1024 * 1024);
    uint64_t remaining = size;
    uint64_t cursor = offset;
    while (remaining > 0) {
        const size_t chunk = static_cast<size_t>(std::min<uint64_t>(buffer.size(), remaining));
        if (!reader.read_at(cursor, buffer.data(), chunk)) {
            error = trs("Read error while exporting carved file");
            return false;
        }
        out.write(reinterpret_cast<const char*>(buffer.data()), static_cast<std::streamsize>(chunk));
        if (!out) {
            error = trs("Write error while exporting carved file");
            return false;
        }
        cursor += chunk;
        remaining -= chunk;
    }
    return true;
}
 
bool carve_one_range(DiskReader& reader,
                     uint64_t range_offset,
                     uint64_t range_size,
                     const std::vector<Pattern>& pats,
                     const std::string& output_dir,
                     std::vector<CarvedFile>& carved,
                     std::vector<std::string>& logs,
                     std::string& error) {
    if (range_size == 0) return true;
 
    const uint64_t file_size = reader.size();
    if (range_offset >= file_size) return true;
    const uint64_t range_end = std::min<uint64_t>(file_size, range_offset + range_size);
 
    std::vector<unsigned char> buffer(WINDOW);
 
    uint64_t base = range_offset;
    while (base < range_end) {
        const size_t to_read = static_cast<size_t>(std::min<uint64_t>(WINDOW, range_end - base));
        if (!reader.read_at(base, buffer.data(), to_read)) {
            error = trs("Read error during file carving");
            return false;
        }
        std::vector<unsigned char> chunk(buffer.begin(), buffer.begin() + static_cast<std::ptrdiff_t>(to_read));
 
        for (size_t i = 0; i < chunk.size(); ++i) {
            for (const auto& p : pats) {
                bool match = false;
                if (std::string(p.type) == "MP4") {
                    match = looks_like_mp4(chunk, i);
                } else {
                    match = starts_with_at(chunk, i, p.header);
                }
                if (!match) continue;
 
                const uint64_t abs_off = base + i;
                if (abs_off >= range_end) continue;
                if (!carved.empty() && abs_off < carved.back().offset + carved.back().size) {
                    continue;
                }
 
                uint64_t found_size = 0;
                if (p.footer_required) {
                    const uint64_t search_limit = std::min<uint64_t>(range_end - abs_off, MAX_FILE_SIZE);
                    std::vector<unsigned char> probe(static_cast<size_t>(search_limit));
                    if (!reader.read_at(abs_off, probe.data(), probe.size())) continue;
                    for (size_t j = p.header.size(); j + p.footer.size() <= probe.size(); ++j) {
                        if (std::equal(p.footer.begin(), p.footer.end(), probe.begin() + static_cast<std::ptrdiff_t>(j))) {
                            found_size = j + p.footer.size();
                            break;
                        }
                    }
                    if (found_size == 0) continue;
                } else {
                    found_size = std::min<uint64_t>(16ull * MiB, range_end - abs_off);
                }
 
                std::ostringstream name;
                name << std::string(p.type) << '_' << std::setw(12) << std::setfill('0') << abs_off << p.ext;
                fs::path out_path = fs::path(output_dir) / name.str();
                std::string copy_error;
                if (!copy_range(reader, abs_off, found_size, out_path, copy_error)) {
                    error = copy_error;
                    return false;
                }
 
                carved.push_back(CarvedFile{
                    p.type,
                    p.ext,
                    abs_off,
                    found_size,
                    p.footer_required ? 0.72 : 0.45,
                    p.footer_required ? trs("Recovered by header/footer carving") : trs("Recovered by header-based carving"),
                    out_path.string()
                });
                logs.push_back(trs("Recovered carved file:") + std::string(" ") + out_path.string());
                break;
            }
        }
        if (base + to_read >= range_end) break;
        base += MiB;
    }
 
    return true;
}
} // namespace
 
bool FileCarver::carve_to_directory(DiskReader& reader,
                                    const std::string& output_dir,
                                    std::vector<CarvedFile>& carved,
                                    std::vector<std::string>& logs,
                                    std::string& error) {
    return carve_ranges_to_directory(reader, {{0, reader.size()}}, output_dir, carved, logs, error);
}
 
bool FileCarver::carve_ranges_to_directory(DiskReader& reader,
                                           const std::vector<std::pair<uint64_t, uint64_t>>& ranges,
                                           const std::string& output_dir,
                                           std::vector<CarvedFile>& carved,
                                           std::vector<std::string>& logs,
                                           std::string& error) {
    carved.clear();
    const auto pats = patterns();
 
    try {
        fs::create_directories(output_dir);
    } catch (const std::exception& ex) {
        error = ex.what();
        return false;
    }
 
    logs.push_back(trs("File carving started."));
    for (const auto& range : ranges) {
        if (!carve_one_range(reader, range.first, range.second, pats, output_dir, carved, logs, error)) {
            return false;
        }
    }
    logs.push_back(trs("File carving completed."));
    return true;
}