OrcCommand: WolfLauncher: print file size when added to upload queue

DFIR-ORC · Nov 20, 2020 · facb7c9 · facb7c9
1 parent 873a38f
commit facb7c9
Show file tree

Hide file tree

Showing 4 changed files with 32 additions and 1 deletion.
diff --git a/src/OrcCommand/WolfLauncher_Run.cpp b/src/OrcCommand/WolfLauncher_Run.cpp
@@ -160,7 +160,8 @@ HRESULT Main::InitializeUpload(const OutputSpec::Upload& uploadspec)
                     m_journal.Print(upload->Keyword(), operation, L"Start");
                     break;
                 case UploadNotification::FileAddition:
-                    m_journal.Print(upload->Keyword(), operation, L"Add file: {}", upload->Source());
+                    m_journal.Print(
+                        upload->Keyword(), operation, L"Add file: {} ({})", upload->Source(), upload->FileSize());
                     break;
                 case UploadNotification::DirectoryAddition:
                     m_journal.Print(upload->Keyword(), operation, L"Add directory: {}", upload->Source());

diff --git a/src/OrcLib/UploadAgent.cpp b/src/OrcLib/UploadAgent.cpp
@@ -45,6 +45,11 @@ void UploadAgent::run()
                 {
                     notification = UploadNotification::MakeSuccessNotification(
                         request, UploadNotification::FileAddition, request->LocalName(), request->RemoteName());
+
+                    if (notification)
+                    {
+                        notification->SetFileSize(request->LocalName());
+                    }
                 }
 
                 if (notification)
@@ -120,12 +125,18 @@ void UploadAgent::run()
                             {
                                 notification = UploadNotification::MakeSuccessNotification(
                                     request, UploadNotification::FileAddition, strFileName, strRemoteName);
+
+                                if (notification)
+                                {
+                                    notification->SetFileSize(strFileName);
+                                }
                             }
 
                             if (notification)
                             {
                                 SendResult(notification);
                             }
+
                         }
                         else
                         {

diff --git a/src/OrcLib/UploadNotification.cpp b/src/OrcLib/UploadNotification.cpp
@@ -46,4 +46,17 @@ Orc::UploadNotification::Notification Orc::UploadNotification::MakeFailureNotifi
     return std::make_shared<UploadNotificationT>(type, Failure, request, source, destination, hr, description);
 }
 
+void UploadNotification::SetFileSize(const std::filesystem::path& path)
+{
+    std::error_code ec;
+    auto size = std::filesystem::file_size(path, ec);
+    if (ec)
+    {
+        Log::Debug(L"Failed to get file size for '{}' [{}]", path, ec);
+        return;
+    }
+
+    SetFileSize(size);
+}
+
 UploadNotification::~UploadNotification() {}
diff --git a/src/OrcLib/UploadNotification.h b/src/OrcLib/UploadNotification.h
@@ -16,6 +16,7 @@
 #include <agents.h>
 
 #include "UploadMessage.h"
+#include "Utils/TypeTraits.h"
 
 #pragma managed(push, off)
 
@@ -74,6 +75,10 @@ class ORCLIB_API UploadNotification
     const std::wstring& Destination() const { return m_destination; }
     const std::wstring& Description() const { return m_description; }
 
+    void SetFileSize(const std::filesystem::path& path);
+    void SetFileSize(uint64_t size) { m_fileSize = size; }
+    std::optional<Traits::ByteQuantity<uint64_t>> FileSize() const { return m_fileSize; }
+
     virtual ~UploadNotification();
 
 private:
@@ -84,6 +89,7 @@ class ORCLIB_API UploadNotification
     const std::wstring m_source;
     const std::wstring m_destination;
     std::wstring m_description;
+    std::optional<Traits::ByteQuantity<uint64_t>> m_fileSize;
     HRESULT m_hr;
 
 protected: