Merge pull request #732 from APriestman/isImageTool

Add isImageSupported to the JNI
sleuthkit · Nov 1, 2016 · 0d10369 · 0d10369
2 parents 5f8c396 + 75d71cb
commit 0d10369
Show file tree

Hide file tree

Showing 7 changed files with 163 additions and 0 deletions.
diff --git a/bindings/java/jni/dataModel_SleuthkitJNI.cpp b/bindings/java/jni/dataModel_SleuthkitJNI.cpp
@@ -11,6 +11,7 @@
 #include "tsk/tsk_tools_i.h"
 #include "tsk/auto/tsk_case_db.h"
 #include "tsk/hashdb/tsk_hash_info.h"
+#include "tsk/auto/tsk_is_image_supported.h"
 #include "jni.h"
 #include "dataModel_SleuthkitJNI.h"
 #include <locale.h>
@@ -2005,3 +2006,43 @@ JNIEXPORT jlong JNICALL Java_org_sleuthkit_datamodel_SleuthkitJNI_findDeviceSize
 
       return devSize;
 }
+
+/*
+ * Test whether an image is supported
+ * @param env pointer to java environment this was called from
+ * @param obj the java object this was called from
+ * @param imagePathJ the image path
+ * @return true if the image can be processed, false otherwise
+ */
+JNIEXPORT jboolean JNICALL Java_org_sleuthkit_datamodel_SleuthkitJNI_isImageSupportedNat
+  (JNIEnv * env, jclass obj, jstring imagePathJ) {
+
+    TskIsImageSupported tskIsImage;
+    TSK_TCHAR imagePathT[1024];
+    toTCHAR(env, imagePathT, 1024, imagePathJ);
+
+    // It seems like passing &imagePathT should work instead of making this new array,
+    // but it generated an EXCEPTION_ACCESS_VIOLATION during testing.
+    TSK_TCHAR ** imagePaths = (TSK_TCHAR**)tsk_malloc((1) * sizeof(TSK_TCHAR*));
+    bool result;
+    imagePaths[0] = imagePathT;
+    if (tskIsImage.openImage(1, imagePaths, TSK_IMG_TYPE_DETECT, 0)) {
+        result = false;
+    } else {
+        if (tskIsImage.findFilesInImg()) {
+            result = false;
+        } else {
+            if (tskIsImage.isImageSupported()) {
+                result = true;
+            }
+            else {
+                result = false;
+            }   
+        }
+    }
+
+    // Cleanup
+    free(imagePaths);
+
+    return (jboolean) result;
+}
diff --git a/bindings/java/jni/dataModel_SleuthkitJNI.h b/bindings/java/jni/dataModel_SleuthkitJNI.h
diff --git a/bindings/java/src/org/sleuthkit/datamodel/SleuthkitJNI.java b/bindings/java/src/org/sleuthkit/datamodel/SleuthkitJNI.java
@@ -946,6 +946,10 @@ private static String timezoneLongToShort(String timezoneLongForm) {
 	public static long findDeviceSize(String devPath) throws TskCoreException {
 		return findDeviceSizeNat(devPath);
 	}
+
+	public static boolean isImageSupported(String imagePath){
+		return isImageSupportedNat(imagePath);
+	}
 
 	private static native String getVersionNat();
 
@@ -1042,5 +1046,7 @@ public static long findDeviceSize(String devPath) throws TskCoreException {
 	private static native long findDeviceSizeNat(String devicePath) throws TskCoreException;
 
 	private static native String getCurDirNat(long process);
+
+	private static native boolean isImageSupportedNat(String imagePath);
 
 }
diff --git a/tsk/auto/is_image_supported.cpp b/tsk/auto/is_image_supported.cpp
@@ -0,0 +1,63 @@
+/*
+ ** The Sleuth Kit
+ **
+ ** Brian Carrier [carrier <at> sleuthkit [dot] org]
+ ** Copyright (c) 2010-2013 Brian Carrier.  All Rights reserved
+ **
+ ** This software is distributed under the Common Public License 1.0
+ **
+ */
+
+/**
+ * \file tsk_is_image_supported.cpp
+ * Class to test whether a given image can be processed by tsk
+ * 
+ * Usage:
+ *  Create a TskIsImageSupported object
+ *  Call openImage
+ *  Call findFilesInImg
+ *  Call isImageSupported - if this returns true then the image is supported. If false or
+ *                            if there was an error along the way, the image is not supported
+ */
+
+#include "tsk_is_image_supported.h"
+
+TskIsImageSupported::TskIsImageSupported()
+{
+    m_wasDataFound = false;
+}
+
+bool TskIsImageSupported::isImageSupported()
+{
+    return m_wasDataFound ;
+}
+
+
+uint8_t TskIsImageSupported::handleError() 
+{
+    // we don't care about errors for this use case
+    //fprintf(stderr, "%s", tsk_error_get());
+    return 0;
+}
+
+
+TSK_RETVAL_ENUM TskIsImageSupported::processFile(TSK_FS_FILE * fs_file, const char *path)
+{
+    return TSK_OK;
+}
+
+
+TSK_FILTER_ENUM
+TskIsImageSupported::filterFs(TSK_FS_INFO * fs_info)
+{
+    m_wasDataFound = true;
+    return TSK_FILTER_SKIP;
+}
+
+
+TSK_FILTER_ENUM
+TskIsImageSupported::filterVol(const TSK_VS_PART_INFO * vs_part)
+{
+    m_wasDataFound = true;
+    return TSK_FILTER_SKIP;
+}
diff --git a/tsk/auto/tsk_is_image_supported.h b/tsk/auto/tsk_is_image_supported.h
@@ -0,0 +1,37 @@
+/*
+ ** The Sleuth Kit
+ ** 
+ ** Brian Carrier [carrier <at> sleuthkit [dot] org]
+ ** Copyright (c) 2010-2013 Brian Carrier.  All Rights reserved
+ **
+ ** This software is distributed under the Common Public License 1.0
+ **
+ */
+
+/**
+ * \file tsk_is_image_supported.cpp
+ * Class to test whether a given image can be processed by tsk
+ * 
+ * Usage:
+ *  Create a TskIsImageSupported object
+ *  Call openImage
+ *  Call findFilesInImg
+ *  Call isImageSupported - if this returns true then the image is supported. If false or
+ *                            if there was an error along the way, the image is not supported
+ */
+
+
+#include "tsk/tsk_tools_i.h"
+
+class TskIsImageSupported:public TskAuto {
+public:
+    TskIsImageSupported();
+    virtual TSK_RETVAL_ENUM processFile(TSK_FS_FILE * fs_file, const char *path);
+    virtual TSK_FILTER_ENUM filterVol(const TSK_VS_PART_INFO * vs_part);
+    virtual TSK_FILTER_ENUM filterFs(TSK_FS_INFO * fs_info);
+    virtual uint8_t handleError();
+    bool isImageSupported();
+
+private:
+    bool m_wasDataFound;
+};
diff --git a/win32/libtsk/libtsk.vcxproj b/win32/libtsk/libtsk.vcxproj
@@ -473,6 +473,7 @@ xcopy /E /Y "$(VCInstallDir)\redist\$(PlatformTarget)\Microsoft.VC140.CRT" "$(Ou
   <ItemGroup>
     <ClCompile Include="..\..\tsk\auto\db_postgresql.cpp" />
     <ClCompile Include="..\..\tsk\auto\guid.cpp" />
+    <ClCompile Include="..\..\tsk\auto\is_image_supported.cpp" />
     <ClCompile Include="..\..\tsk\auto\tsk_db.cpp" />
     <ClCompile Include="..\..\tsk\fs\exfatfs_dent.c" />
     <ClCompile Include="..\..\tsk\fs\exfatfs.c" />
@@ -576,6 +577,7 @@ xcopy /E /Y "$(VCInstallDir)\redist\$(PlatformTarget)\Microsoft.VC140.CRT" "$(Ou
     <ClInclude Include="..\..\tsk\auto\guid.h" />
     <ClInclude Include="..\..\tsk\auto\tsk_db.h" />
     <ClInclude Include="..\..\tsk\auto\tsk_db_postgresql.h" />
+    <ClInclude Include="..\..\tsk\auto\tsk_is_image_supported.h" />
     <ClInclude Include="..\..\tsk\fs\tsk_exfatfs.h" />
     <ClInclude Include="..\..\tsk\fs\tsk_fatxxfs.h" />
     <ClInclude Include="..\..\tsk\hashdb\tsk_hash_info.h" />

diff --git a/win32/libtsk/libtsk.vcxproj.filters b/win32/libtsk/libtsk.vcxproj.filters
@@ -318,6 +318,9 @@
     <ClCompile Include="..\..\tsk\auto\guid.cpp">
       <Filter>auto</Filter>
     </ClCompile>
+    <ClCompile Include="..\..\tsk\auto\is_image_supported.cpp">
+      <Filter>auto</Filter>
+    </ClCompile>
   </ItemGroup>
   <ItemGroup>
     <ClInclude Include="..\..\tsk\vs\tsk_bsd.h">
@@ -440,5 +443,8 @@
     <ClInclude Include="..\..\tsk\auto\guid.h">
       <Filter>auto</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\tsk\auto\tsk_is_image_supported.h">
+      <Filter>auto</Filter>
+    </ClInclude>
   </ItemGroup>
 </Project>