TskCarvePrepSectorConcat Class Reference

The TskCarvePrepSectorConcat class implements the CarvePrep abstract interface. More...

#include <TskCarvePrepSectorConcat.h>

Inheritance diagram for TskCarvePrepSectorConcat:

Public Member Functions
void	processFiles (const std::string &fileName) const
	Treats the contents of a set of files as unallocated sector runs and writes the contents of the files to zero to many unallocated sectors image files for later carving. More...
virtual int	processSectors ()
	Make one or more unallocated sectors image files to carve. More...
Public Member Functions inherited from CarvePrep
virtual	~CarvePrep (void)
	Virtual destructor to ensure derived class constructors are called polymorphically.

Protected Member Functions
virtual void	onUnallocSectorsImgFileCreated (int unallocSectorsImgId) const
	Called by createUnallocSectorsImgFiles to allow specialization of behavior when an unallocated sectors image file is produced. More...

Detailed Description

The TskCarvePrepSectorConcat class implements the CarvePrep abstract interface.

It concatenates unallocated sector runs from an image and writes the contents to one or more unallocated sectors image files with a configurable maximum size. Instances of this class are also able to treat a file as a run of unallocated sectors, whcih may be helpful for carving page files, etc.

This class assumes the availability of the Microsoft Windows API. @@ TODO: Use Poco API instead.

Member Function Documentation

void TskCarvePrepSectorConcat::onUnallocSectorsImgFileCreated ( int  unallocSectorsImgId) const

protectedvirtual

Called by createUnallocSectorsImgFiles to allow specialization of behavior when an unallocated sectors image file is produced.

The default implementation optionally schedules carving of the output file.

Parameters

unallocSectorsImgId

ID assigned to the file by TskImgDB::addUnallocImg().

Returns

Default implementation throws TskException on error.

References Scheduler::Carve, TskServices::getImgDB(), and TskServices::Instance().

void TskCarvePrepSectorConcat::processFiles

(

const std::string &

fileName)

const

Treats the contents of a set of files as unallocated sector runs and writes the contents of the files to zero to many unallocated sectors image files for later carving.

This may be useful for carving page files, hibernation files, etc.

Parameters

fileName

Output files for all files with this name will be generated.

Returns

Throws TskException on error.

References TskServices::getImgDB(), and TskServices::Instance().

int TskCarvePrepSectorConcat::processSectors ( )

virtual

Make one or more unallocated sectors image files to carve.

Returns

0 on success, 1 on error.

Implements CarvePrep.

References TskServices::Instance(), LOGERROR, and TskException::message().

---

The documentation for this class was generated from the following files:

• framework/tsk/framework/extraction/TskCarvePrepSectorConcat.h
• framework/tsk/framework/extraction/TskCarvePrepSectorConcat.cpp