The Sleuth Kit Framework  4.1
Public Member Functions | Protected Member Functions | List of all members
TskCarvePrepSectorConcat Class Reference

The TskCarvePrepSectorConcat class implements the CarvePrep abstract interface. More...

#include <TskCarvePrepSectorConcat.h>

Inheritance diagram for TskCarvePrepSectorConcat:
CarvePrep

Public Member Functions

void processFiles (const std::string &fileName) const
 Treats the contents of a set of files as unallocated sector runs and writes the contents of the files to zero to many unallocated sectors image files for later carving. More...
 
virtual int processSectors ()
 Make one or more unallocated sectors image files to carve. More...
 
- Public Member Functions inherited from CarvePrep
virtual ~CarvePrep (void)
 Virtual destructor to ensure derived class constructors are called polymorphically.
 

Protected Member Functions

virtual void onUnallocSectorsImgFileCreated (int unallocSectorsImgId) const
 Called by createUnallocSectorsImgFiles to allow specialization of behavior when an unallocated sectors image file is produced. More...
 

Detailed Description

The TskCarvePrepSectorConcat class implements the CarvePrep abstract interface.

It concatenates unallocated sector runs from an image and writes the contents to one or more unallocated sectors image files with a configurable maximum size. Instances of this class are also able to treat a file as a run of unallocated sectors, whcih may be helpful for carving page files, etc.

This class assumes the availability of the Microsoft Windows API. @@ TODO: Use Poco API instead.

Member Function Documentation

void TskCarvePrepSectorConcat::onUnallocSectorsImgFileCreated ( int  unallocSectorsImgId) const
protectedvirtual

Called by createUnallocSectorsImgFiles to allow specialization of behavior when an unallocated sectors image file is produced.

The default implementation optionally schedules carving of the output file.

Parameters
unallocSectorsImgIdID assigned to the file by TskImgDB::addUnallocImg().
Returns
Default implementation throws TskException on error.

References Scheduler::Carve, TskServices::getImgDB(), and TskServices::Instance().

void TskCarvePrepSectorConcat::processFiles ( const std::string &  fileName) const

Treats the contents of a set of files as unallocated sector runs and writes the contents of the files to zero to many unallocated sectors image files for later carving.

This may be useful for carving page files, hibernation files, etc.

Parameters
fileNameOutput files for all files with this name will be generated.
Returns
Throws TskException on error.

References TskServices::getImgDB(), and TskServices::Instance().

int TskCarvePrepSectorConcat::processSectors ( )
virtual

Make one or more unallocated sectors image files to carve.

Returns
0 on success, 1 on error.

Implements CarvePrep.

References TskServices::Instance(), LOGERROR, and TskException::message().


The documentation for this class was generated from the following files:

Copyright © 2011-2013 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.