diff --git a/tsk/auto/auto_db.cpp b/tsk/auto/auto_db.cpp index 5ede98c32692c36ebb0cf1234004942084f850f8..2658aa7e432ee4bb4994825d92339e51a11fbe03 100644 --- a/tsk/auto/auto_db.cpp +++ b/tsk/auto/auto_db.cpp @@ -30,7 +30,7 @@ using std::for_each; * @param a_NSRLDb Database of "known" files (can be NULL) * @param a_knownBadDb Database of "known bad" files (can be NULL) */ -TskAutoDb::TskAutoDb(TskDbSqlite * a_db, TSK_HDB_INFO * a_NSRLDb, TSK_HDB_INFO * a_knownBadDb) +TskAutoDb::TskAutoDb(TskDb * a_db, TSK_HDB_INFO * a_NSRLDb, TSK_HDB_INFO * a_knownBadDb) { m_db = a_db; m_curImgId = 0; diff --git a/tsk/auto/case_db.cpp b/tsk/auto/case_db.cpp index b505347a73c4a915b580a5658940f490773f0754..98dfbdeef189571b48e4f59941f33fb727fae1ab 100644 --- a/tsk/auto/case_db.cpp +++ b/tsk/auto/case_db.cpp @@ -17,7 +17,7 @@ #include "tsk_case_db.h" #include "tsk_auto_i.h" -TskCaseDb::TskCaseDb(TskDbSqlite * a_db) +TskCaseDb::TskCaseDb(TskDb * a_db) { m_tag = TSK_CASE_DB_TAG; m_db = a_db; @@ -65,7 +65,7 @@ TskCaseDb::newDb(const TSK_TCHAR * const path) return NULL; } - TskDbSqlite *db = new TskDbSqlite(path, true); + TskDb *db = new TskDbSqlite(path, true); // Open the database. if (db->open(true)) { @@ -95,7 +95,7 @@ TskCaseDb::openDb(const TSK_TCHAR * path) return NULL; } - TskDbSqlite *db = new TskDbSqlite(path, true); + TskDb *db = new TskDbSqlite(path, true); // Open the database. if (db->open(false)) { diff --git a/tsk/auto/db_sqlite.cpp b/tsk/auto/db_sqlite.cpp index 68e822d488ab26c53c47140c3c6ec391846448ab..9a5ea0d42dc7ef733cffa324f270a65b753c8d0d 100755 --- a/tsk/auto/db_sqlite.cpp +++ b/tsk/auto/db_sqlite.cpp @@ -17,7 +17,6 @@ #include "sqlite3.h" #include <string.h> - #include <sstream> #include <algorithm> @@ -32,6 +31,7 @@ using std::for_each; * open() before the object can be used. */ TskDbSqlite::TskDbSqlite(const char *a_dbFilePathUtf8, bool a_blkMapFlag) + : TskDb(a_dbFilePathUtf8, a_blkMapFlag) { strncpy(m_dbFilePathUtf8, a_dbFilePathUtf8, 1024); m_utf8 = true; @@ -44,6 +44,7 @@ TskDbSqlite::TskDbSqlite(const char *a_dbFilePathUtf8, bool a_blkMapFlag) #ifdef TSK_WIN32 //@@@@ TskDbSqlite::TskDbSqlite(const TSK_TCHAR * a_dbFilePath, bool a_blkMapFlag) + : TskDb(a_dbFilePath, a_blkMapFlag) { wcsncpy(m_dbFilePath, a_dbFilePath, 1024); m_utf8 = false; diff --git a/tsk/auto/tsk_case_db.h b/tsk/auto/tsk_case_db.h index 634f12f3ee9e7eecf4784df8753545e291c2fafb..ba16d1ca3304464ec49c216c1e4a3e21dace4ea5 100644 --- a/tsk/auto/tsk_case_db.h +++ b/tsk/auto/tsk_case_db.h @@ -33,7 +33,7 @@ using std::string; */ class TskAutoDb:public TskAuto { public: - TskAutoDb(TskDbSqlite * a_db, TSK_HDB_INFO * a_NSRLDb, TSK_HDB_INFO * a_knownBadDb); + TskAutoDb(TskDb * a_db, TSK_HDB_INFO * a_NSRLDb, TSK_HDB_INFO * a_knownBadDb); virtual ~ TskAutoDb(); virtual uint8_t openImage(int, const TSK_TCHAR * const images[], TSK_IMG_TYPE_ENUM, unsigned int a_ssize); @@ -94,7 +94,7 @@ class TskAutoDb:public TskAuto { int64_t commitAddImage(); private: - TskDbSqlite * m_db; + TskDb * m_db; int64_t m_curImgId; ///< Object ID of image currently being processed int64_t m_curVsId; ///< Object ID of volume system currently being processed int64_t m_curVolId; ///< Object ID of volume currently being processed @@ -187,8 +187,8 @@ class TskCaseDb { TskCaseDb(const TskCaseDb&); TskCaseDb & operator=(const TskCaseDb&); - TskCaseDb(TskDbSqlite * a_db); - TskDbSqlite *m_db; + TskCaseDb(TskDb * a_db); + TskDb *m_db; TSK_HDB_INFO * m_NSRLDb; TSK_HDB_INFO * m_knownBadDb; }; diff --git a/tsk/auto/tsk_db.cpp b/tsk/auto/tsk_db.cpp new file mode 100755 index 0000000000000000000000000000000000000000..de6279fd8b92cfccb22c2e7ae1339e08af9087dd --- /dev/null +++ b/tsk/auto/tsk_db.cpp @@ -0,0 +1,34 @@ +/* +** The Sleuth Kit +** +** Brian Carrier [carrier <at> sleuthkit [dot] org] +** Copyright (c) 2010-2013 Brian Carrier. All Rights reserved +** +** This software is distributed under the Common Public License 1.0 +** +*/ + +/** +* \file tsk_db.cpp +* Contains code related to abstract TSK database handling class. +*/ + +#include "tsk_db.h" + +/** +* Set the locations and logging object. Must call +* open() before the object can be used. +*/ +TskDb::TskDb(const char *a_dbFilePathUtf8, bool a_blkMapFlag) +{ + +} + +#ifdef TSK_WIN32 +//@@@@ +TskDb::TskDb(const TSK_TCHAR * a_dbFilePath, bool a_blkMapFlag) +{ + +} +#endif + diff --git a/tsk/auto/tsk_db.h b/tsk/auto/tsk_db.h new file mode 100755 index 0000000000000000000000000000000000000000..89cf6e9f19c261daef1b3efcb9d9550aa4177341 --- /dev/null +++ b/tsk/auto/tsk_db.h @@ -0,0 +1,199 @@ +/* + ** The Sleuth Kit + ** + ** Brian Carrier [carrier <at> sleuthkit [dot] org] + ** Copyright (c) 2011-2012 Brian Carrier. All Rights reserved + ** + ** This software is distributed under the Common Public License 1.0 + ** + */ + +/** + * \file tsk_db.h + * Contains TSK interface to abstract database handling class. The intent of this class + * is so that different databases can be seamlesly used by TSK. + */ + +#ifndef _TSK_DB_H +#define _TSK_DB_H + +#include <vector> +#include <string> +#include <ostream> + +#include "tsk_auto_i.h" + +using std::ostream; +using std::vector; +using std::string; + +/** + * Values for the type column in the tsk_objects table. + */ +typedef enum { + TSK_DB_OBJECT_TYPE_IMG = 0, ///< Object is a disk image + TSK_DB_OBJECT_TYPE_VS, ///< Object is a volume system. + TSK_DB_OBJECT_TYPE_VOL, ///< Object is a volume + TSK_DB_OBJECT_TYPE_FS, ///< Object is a file system + TSK_DB_OBJECT_TYPE_FILE, ///< Object is a file (exact type can be determined in the tsk_files table via TSK_DB_FILES_TYPE_ENUM) +} TSK_DB_OBJECT_TYPE_ENUM; + +/** + * Values for the files type column in the tsk_files table. + */ +typedef enum { + TSK_DB_FILES_TYPE_FS = 0, ///< File that can be found in file system tree. + TSK_DB_FILES_TYPE_CARVED, ///< Set of blocks for a file found from carving. Could be on top of a TSK_DB_FILES_TYPE_UNALLOC_BLOCKS range. + TSK_DB_FILES_TYPE_DERIVED, ///< File derived from a parent file (i.e. from ZIP) + TSK_DB_FILES_TYPE_LOCAL, ///< Local file that was added (not from a disk image) + TSK_DB_FILES_TYPE_UNALLOC_BLOCKS, ///< Set of blocks not allocated by file system. Parent should be image, volume, or file system. Many columns in tsk_files will be NULL. Set layout in tsk_file_layout. + TSK_DB_FILES_TYPE_UNUSED_BLOCKS, ///< Set of blocks that are unallocated AND not used by a carved or other file type. Parent should be UNALLOC_BLOCKS, many columns in tsk_files will be NULL, set layout in tsk_file_layout. + TSK_DB_FILES_TYPE_VIRTUAL_DIR, ///< Virtual directory (not on fs) with no meta-data entry that can be used to group files of types other than TSK_DB_FILES_TYPE_FS. Its parent is either another TSK_DB_FILES_TYPE_FS or a root directory or type TSK_DB_FILES_TYPE_FS. +} TSK_DB_FILES_TYPE_ENUM; + + + +/** +* Values for the "known" column of the tsk_files table +*/ +typedef enum { + TSK_DB_FILES_KNOWN_UNKNOWN = 0, ///< Not matched against an index + TSK_DB_FILES_KNOWN_KNOWN = 1, ///< Match found in a "known" file index (such as NIST NSRL)and could be good or bad. + TSK_DB_FILES_KNOWN_KNOWN_BAD = 2, ///< Match found in a "known bad" index + TSK_DB_FILES_KNOWN_KNOWN_GOOD = 3, ///< Match found in a "known good" index +} TSK_DB_FILES_KNOWN_ENUM; + + +/** +* Structure wrapping a single tsk objects db entry +*/ +typedef struct _TSK_DB_OBJECT { + int64_t objId; ///< set to 0 if unknown (before it becomes a db object) + int64_t parObjId; + TSK_DB_OBJECT_TYPE_ENUM type; +} TSK_DB_OBJECT; + +ostream& operator <<(ostream &os,const TSK_DB_OBJECT &dbObject); + +/** +* Structure wrapping a single file_layout db entry +*/ +typedef struct _TSK_DB_FILE_LAYOUT_RANGE { + //default constructor + _TSK_DB_FILE_LAYOUT_RANGE() + : fileObjId(0),byteStart(0),byteLen(0),sequence(0) {} + //constructor for non-db object (before it becomes one) + _TSK_DB_FILE_LAYOUT_RANGE(uint64_t byteStart, uint64_t byteLen, int sequence) + : fileObjId(0),byteStart(byteStart),byteLen(byteLen),sequence(sequence) {} + + int64_t fileObjId; ///< set to 0 if unknown (before it becomes a db object) + uint64_t byteStart; + uint64_t byteLen; + int sequence; + + //default comparator by sequence + bool operator< (const struct _TSK_DB_FILE_LAYOUT_RANGE & rhs) const + { return sequence < rhs.sequence; } + +} TSK_DB_FILE_LAYOUT_RANGE; + +ostream& operator <<(ostream &os,const TSK_DB_FILE_LAYOUT_RANGE &layoutRange); + +/** +* Structure wrapping a single fs info db entry +*/ +typedef struct _TSK_DB_FS_INFO { + int64_t objId; ///< set to 0 if unknown (before it becomes a db object) + TSK_OFF_T imgOffset; + TSK_FS_TYPE_ENUM fType; + unsigned int block_size; + TSK_DADDR_T block_count; + TSK_INUM_T root_inum; + TSK_INUM_T first_inum; + TSK_INUM_T last_inum; +} TSK_DB_FS_INFO; + +ostream& operator <<(ostream &os,const TSK_DB_FS_INFO &fsInfo); + + +/** +* Structure wrapping a single vs info db entry +*/ +typedef struct _TSK_DB_VS_INFO { + int64_t objId; ///< set to 0 if unknown (before it becomes a db object) + TSK_VS_TYPE_ENUM vstype; + TSK_DADDR_T offset; + unsigned int block_size; +} TSK_DB_VS_INFO; + +ostream& operator <<(ostream &os,const TSK_DB_VS_INFO &vsInfo); + +/** +* Structure wrapping a single vs part db entry +*/ +#define TSK_MAX_DB_VS_PART_INFO_DESC_LEN 512 +typedef struct _TSK_DB_VS_PART_INFO { + int64_t objId; ///< set to 0 if unknown (before it becomes a db object) + TSK_PNUM_T addr; + TSK_DADDR_T start; + TSK_DADDR_T len; + char desc[TSK_MAX_DB_VS_PART_INFO_DESC_LEN]; + TSK_VS_PART_FLAG_ENUM flags; +} TSK_DB_VS_PART_INFO; + +ostream& operator <<(ostream &os,const TSK_DB_VS_PART_INFO &vsPartInfos); + +/** \internal + * C++ class that serves as interface to direct database handling classes. + */ +class TskDb { + public: +#ifdef TSK_WIN32 +//@@@@ + TskDb(const TSK_TCHAR * a_dbFilePath, bool a_blkMapFlag); +#endif + TskDb(const char *a_dbFilePathUtf8, bool a_blkMapFlag); + virtual ~TskDb() {}; + virtual int open(bool) = 0; + virtual int close() = 0; + virtual int addImageInfo(int type, int size, int64_t & objId, const string & timezone) = 0; + virtual int addImageInfo(int type, int size, int64_t & objId, const string & timezone, TSK_OFF_T, const string &md5) = 0; + virtual int addImageName(int64_t objId, char const *imgName, int sequence) = 0; + virtual int addVsInfo(const TSK_VS_INFO * vs_info, int64_t parObjId, int64_t & objId) = 0; + virtual int addVolumeInfo(const TSK_VS_PART_INFO * vs_part, int64_t parObjId, int64_t & objId) = 0; + virtual int addFsInfo(const TSK_FS_INFO * fs_info, int64_t parObjId, int64_t & objId) = 0; + virtual int addFsFile(TSK_FS_FILE * fs_file, const TSK_FS_ATTR * fs_attr, + const char *path, const unsigned char *const md5, + const TSK_DB_FILES_KNOWN_ENUM known, int64_t fsObjId, + int64_t & objId) = 0; + + virtual TSK_RETVAL_ENUM addVirtualDir(const int64_t fsObjId, const int64_t parentDirId, const char * const name, int64_t & objId) = 0; + virtual TSK_RETVAL_ENUM addUnallocFsBlockFilesParent(const int64_t fsObjId, int64_t & objId) = 0; + virtual TSK_RETVAL_ENUM addUnallocBlockFile(const int64_t parentObjId, const int64_t fsObjId, const uint64_t size, + vector<TSK_DB_FILE_LAYOUT_RANGE> & ranges, int64_t & objId) = 0; + virtual TSK_RETVAL_ENUM addUnusedBlockFile(const int64_t parentObjId, const int64_t fsObjId, const uint64_t size, + vector<TSK_DB_FILE_LAYOUT_RANGE> & ranges, int64_t & objId) = 0; + virtual TSK_RETVAL_ENUM addCarvedFile(const int64_t parentObjId, const int64_t fsObjId, const uint64_t size, + vector<TSK_DB_FILE_LAYOUT_RANGE> & ranges, int64_t & objId) = 0; + + virtual int addFileLayoutRange(const TSK_DB_FILE_LAYOUT_RANGE & fileLayoutRange) = 0; + virtual int addFileLayoutRange(int64_t a_fileObjId, uint64_t a_byteStart, uint64_t a_byteLen, int a_sequence) = 0; + + virtual bool dbExist() const = 0; + virtual int createSavepoint(const char *name) = 0; + virtual int revertSavepoint(const char *name) = 0; + virtual int releaseSavepoint(const char *name) = 0; + virtual bool inTransaction() = 0; + + //query methods / getters + virtual TSK_RETVAL_ENUM getFileLayouts(vector<TSK_DB_FILE_LAYOUT_RANGE> & fileLayouts) = 0; + virtual TSK_RETVAL_ENUM getFsInfos(int64_t imgId, vector<TSK_DB_FS_INFO> & fsInfos) = 0; + virtual TSK_RETVAL_ENUM getVsInfos(int64_t imgId, vector<TSK_DB_VS_INFO> & vsInfos) = 0; + virtual TSK_RETVAL_ENUM getVsInfo(int64_t objId, TSK_DB_VS_INFO & vsInfo) = 0; + virtual TSK_RETVAL_ENUM getVsPartInfos(int64_t imgId, vector<TSK_DB_VS_PART_INFO> & vsPartInfos) = 0; + virtual TSK_RETVAL_ENUM getObjectInfo(int64_t objId, TSK_DB_OBJECT & objectInfo) = 0; + virtual TSK_RETVAL_ENUM getParentImageId (const int64_t objId, int64_t & imageId) = 0; + virtual TSK_RETVAL_ENUM getFsRootDirObjectInfo(const int64_t fsObjId, TSK_DB_OBJECT & rootDirObjInfo) = 0; +}; + +#endif diff --git a/tsk/auto/tsk_db_sqlite.h b/tsk/auto/tsk_db_sqlite.h index 8eeae9b9a691813215efd7de6073ef09d96af69e..e0586b149ac6000db072f8c75f0b0f09f4d165a9 100755 --- a/tsk/auto/tsk_db_sqlite.h +++ b/tsk/auto/tsk_db_sqlite.h @@ -11,151 +11,24 @@ /** * \file tsk_db_sqlite.h * Contains the SQLite code for maintaining the case-level database. - * In the future, an interface will be developed for these so that - * different databases can exist. + * The class is an extension of TSK abstract database handling class. */ #ifndef _TSK_DB_SQLITE_H #define _TSK_DB_SQLITE_H #include <map> -#include <vector> - -#include <string> -#include <ostream> - #include "sqlite3.h" -#include "tsk_auto_i.h" +#include "tsk_db.h" using std::map; -using std::vector; -using std::string; -using std::ostream; - -typedef struct sqlite3 sqlite3; - - -/** - * Values for the type column in the tsk_objects table. - */ -typedef enum { - TSK_DB_OBJECT_TYPE_IMG = 0, ///< Object is a disk image - TSK_DB_OBJECT_TYPE_VS, ///< Object is a volume system. - TSK_DB_OBJECT_TYPE_VOL, ///< Object is a volume - TSK_DB_OBJECT_TYPE_FS, ///< Object is a file system - TSK_DB_OBJECT_TYPE_FILE, ///< Object is a file (exact type can be determined in the tsk_files table via TSK_DB_FILES_TYPE_ENUM) -} TSK_DB_OBJECT_TYPE_ENUM; - -/** - * Values for the files type column in the tsk_files table. - */ -typedef enum { - TSK_DB_FILES_TYPE_FS = 0, ///< File that can be found in file system tree. - TSK_DB_FILES_TYPE_CARVED, ///< Set of blocks for a file found from carving. Could be on top of a TSK_DB_FILES_TYPE_UNALLOC_BLOCKS range. - TSK_DB_FILES_TYPE_DERIVED, ///< File derived from a parent file (i.e. from ZIP) - TSK_DB_FILES_TYPE_LOCAL, ///< Local file that was added (not from a disk image) - TSK_DB_FILES_TYPE_UNALLOC_BLOCKS, ///< Set of blocks not allocated by file system. Parent should be image, volume, or file system. Many columns in tsk_files will be NULL. Set layout in tsk_file_layout. - TSK_DB_FILES_TYPE_UNUSED_BLOCKS, ///< Set of blocks that are unallocated AND not used by a carved or other file type. Parent should be UNALLOC_BLOCKS, many columns in tsk_files will be NULL, set layout in tsk_file_layout. - TSK_DB_FILES_TYPE_VIRTUAL_DIR, ///< Virtual directory (not on fs) with no meta-data entry that can be used to group files of types other than TSK_DB_FILES_TYPE_FS. Its parent is either another TSK_DB_FILES_TYPE_FS or a root directory or type TSK_DB_FILES_TYPE_FS. -} TSK_DB_FILES_TYPE_ENUM; - - - -/** -* Values for the "known" column of the tsk_files table -*/ -typedef enum { - TSK_DB_FILES_KNOWN_UNKNOWN = 0, ///< Not matched against an index - TSK_DB_FILES_KNOWN_KNOWN = 1, ///< Match found in a "known" file index (such as NIST NSRL)and could be good or bad. - TSK_DB_FILES_KNOWN_KNOWN_BAD = 2, ///< Match found in a "known bad" index - TSK_DB_FILES_KNOWN_KNOWN_GOOD = 3, ///< Match found in a "known good" index -} TSK_DB_FILES_KNOWN_ENUM; - - -/** -* Structure wrapping a single tsk objects db entry -*/ -typedef struct _TSK_DB_OBJECT { - int64_t objId; ///< set to 0 if unknown (before it becomes a db object) - int64_t parObjId; - TSK_DB_OBJECT_TYPE_ENUM type; -} TSK_DB_OBJECT; - -ostream& operator <<(ostream &os,const TSK_DB_OBJECT &dbObject); - -/** -* Structure wrapping a single file_layout db entry -*/ -typedef struct _TSK_DB_FILE_LAYOUT_RANGE { - //default constructor - _TSK_DB_FILE_LAYOUT_RANGE() - : fileObjId(0),byteStart(0),byteLen(0),sequence(0) {} - //constructor for non-db object (before it becomes one) - _TSK_DB_FILE_LAYOUT_RANGE(uint64_t byteStart, uint64_t byteLen, int sequence) - : fileObjId(0),byteStart(byteStart),byteLen(byteLen),sequence(sequence) {} - - int64_t fileObjId; ///< set to 0 if unknown (before it becomes a db object) - uint64_t byteStart; - uint64_t byteLen; - int sequence; - - //default comparator by sequence - bool operator< (const struct _TSK_DB_FILE_LAYOUT_RANGE & rhs) const - { return sequence < rhs.sequence; } - -} TSK_DB_FILE_LAYOUT_RANGE; - -ostream& operator <<(ostream &os,const TSK_DB_FILE_LAYOUT_RANGE &layoutRange); - -/** -* Structure wrapping a single fs info db entry -*/ -typedef struct _TSK_DB_FS_INFO { - int64_t objId; ///< set to 0 if unknown (before it becomes a db object) - TSK_OFF_T imgOffset; - TSK_FS_TYPE_ENUM fType; - unsigned int block_size; - TSK_DADDR_T block_count; - TSK_INUM_T root_inum; - TSK_INUM_T first_inum; - TSK_INUM_T last_inum; -} TSK_DB_FS_INFO; - -ostream& operator <<(ostream &os,const TSK_DB_FS_INFO &fsInfo); - - -/** -* Structure wrapping a single vs info db entry -*/ -typedef struct _TSK_DB_VS_INFO { - int64_t objId; ///< set to 0 if unknown (before it becomes a db object) - TSK_VS_TYPE_ENUM vstype; - TSK_DADDR_T offset; - unsigned int block_size; -} TSK_DB_VS_INFO; - -ostream& operator <<(ostream &os,const TSK_DB_VS_INFO &vsInfo); - -/** -* Structure wrapping a single vs part db entry -*/ -#define TSK_MAX_DB_VS_PART_INFO_DESC_LEN 512 -typedef struct _TSK_DB_VS_PART_INFO { - int64_t objId; ///< set to 0 if unknown (before it becomes a db object) - TSK_PNUM_T addr; - TSK_DADDR_T start; - TSK_DADDR_T len; - char desc[TSK_MAX_DB_VS_PART_INFO_DESC_LEN]; - TSK_VS_PART_FLAG_ENUM flags; -} TSK_DB_VS_PART_INFO; -ostream& operator <<(ostream &os,const TSK_DB_VS_PART_INFO &vsPartInfos); /** \internal * C++ class that wraps the database internals. */ -class TskDbSqlite { +class TskDbSqlite : public TskDb { public: #ifdef TSK_WIN32 //@@@@ diff --git a/win32/libtsk/libtsk.vcxproj b/win32/libtsk/libtsk.vcxproj index d4a73e8b87bf11998eef912dbc7ce59bb90b8084..29dd8a0697e5c992fe0bea6c79e6bd161f67a8cd 100755 --- a/win32/libtsk/libtsk.vcxproj +++ b/win32/libtsk/libtsk.vcxproj @@ -203,6 +203,7 @@ copy "$(LIBEWF_HOME)\msvscpp\x64\release\zlib.dll" "$(OutDir)" </ClCompile> </ItemDefinitionGroup> <ItemGroup> + <ClCompile Include="..\..\tsk\auto\tsk_db.cpp" /> <ClCompile Include="..\..\tsk\fs\exfatfs_dent.c" /> <ClCompile Include="..\..\tsk\fs\exfatfs.c" /> <ClCompile Include="..\..\tsk\fs\exfatfs_meta.c" /> @@ -299,6 +300,7 @@ copy "$(LIBEWF_HOME)\msvscpp\x64\release\zlib.dll" "$(OutDir)" <ClCompile Include="..\..\tsk\img\raw.c" /> </ItemGroup> <ItemGroup> + <ClInclude Include="..\..\tsk\auto\tsk_db.h" /> <ClInclude Include="..\..\tsk\fs\tsk_exfatfs.h" /> <ClInclude Include="..\..\tsk\fs\tsk_fatxxfs.h" /> <ClInclude Include="..\..\tsk\hashdb\tsk_hash_info.h" /> diff --git a/win32/libtsk/libtsk.vcxproj.filters b/win32/libtsk/libtsk.vcxproj.filters index 0f39599348a0a0ad8a373fff2623626a1b82d68c..d9aa9f8a3f51d514760985ac6832fc2547a533bb 100755 --- a/win32/libtsk/libtsk.vcxproj.filters +++ b/win32/libtsk/libtsk.vcxproj.filters @@ -303,6 +303,9 @@ <ClCompile Include="..\..\tsk\hashdb\binsrch_index.cpp"> <Filter>hash</Filter> </ClCompile> + <ClCompile Include="..\..\tsk\auto\tsk_db.cpp"> + <Filter>auto</Filter> + </ClCompile> </ItemGroup> <ItemGroup> <ClInclude Include="..\..\tsk\vs\tsk_bsd.h"> @@ -407,5 +410,8 @@ <ClInclude Include="..\..\tsk\hashdb\tsk_hash_info.h"> <Filter>hash</Filter> </ClInclude> + <ClInclude Include="..\..\tsk\auto\tsk_db.h"> + <Filter>auto</Filter> + </ClInclude> </ItemGroup> </Project> \ No newline at end of file