diff --git a/bindings/java/jni/auto_db_java.cpp b/bindings/java/jni/auto_db_java.cpp
index 20e915d81c21412a12f83536ad618421b4cfcc1a..e64a55f5af6b5a130599593631d4820d931b7e70 100644
--- a/bindings/java/jni/auto_db_java.cpp
+++ b/bindings/java/jni/auto_db_java.cpp
@@ -1228,21 +1228,27 @@ TskAutoDbJava::addUnallocatedPoolBlocksToDb(size_t & numPool) {
/* Create the unallocated space files */
TSK_FS_ATTR_RUN * unalloc_runs = tsk_pool_unallocated_runs(pool_info);
TSK_FS_ATTR_RUN * current_run = unalloc_runs;
- vector<TSK_DB_FILE_LAYOUT_RANGE> ranges;
+ //vector<TSK_DB_FILE_LAYOUT_RANGE> ranges;
while (current_run != NULL) {
- TSK_DB_FILE_LAYOUT_RANGE tempRange(current_run->addr * pool_info->block_size, current_run->len * pool_info->block_size, 0);
-
- ranges.push_back(tempRange);
- int64_t fileObjId = 0;
- if (TSK_ERR == addUnallocBlockFile(unallocVolObjId, 0, current_run->len * pool_info->block_size, ranges, fileObjId, m_curImgId)) {
+ if (addUnallocBlockFileInChunks(current_run->addr * pool_info->block_size, current_run->len * pool_info->block_size, unallocVolObjId, m_curImgId) == TSK_ERR) {
registerError();
tsk_fs_attr_run_free(unalloc_runs);
return TSK_ERR;
}
+ //TSK_DB_FILE_LAYOUT_RANGE tempRange(current_run->addr * pool_info->block_size, current_run->len * pool_info->block_size, 0);
+
+ //ranges.push_back(tempRange);
+ //int64_t fileObjId = 0;
+ ////if (TSK_ERR == addUnallocBlockFile(unallocVolObjId, 0, current_run->len * pool_info->block_size, ranges, fileObjId, m_curImgId)) {
+ // registerError();
+ // // tsk_fs_attr_run_free(unalloc_runs);
+ return TSK_ERR;
+ // }
+
current_run = current_run->next;
- ranges.clear();
+ // ranges.clear();
}
tsk_fs_attr_run_free(unalloc_runs);
}
@@ -1919,13 +1925,19 @@ TSK_RETVAL_ENUM TskAutoDbJava::addUnallocVsSpaceToDb(size_t & numVsP) {
}
// Create an unalloc file with unalloc part, with vs part as parent
- vector<TSK_DB_FILE_LAYOUT_RANGE> ranges;
+ //vector<TSK_DB_FILE_LAYOUT_RANGE> ranges;
+ //const uint64_t byteStart = vsInfo->offset + vsInfo->block_size * vsPart.start;
+ //const uint64_t byteLen = vsInfo->block_size * vsPart.len;
+ //TSK_DB_FILE_LAYOUT_RANGE tempRange(byteStart, byteLen, 0);
+ //ranges.push_back(tempRange);
+ //int64_t fileObjId = 0;
+ //if (addUnallocBlockFile(vsPart.objId, 0, tempRange.byteLen, ranges, fileObjId, m_curImgId) == TSK_ERR) {
+ // registerError();
+ // return TSK_ERR;
+ //}
const uint64_t byteStart = vsInfo->offset + vsInfo->block_size * vsPart.start;
- const uint64_t byteLen = vsInfo->block_size * vsPart.len;
- TSK_DB_FILE_LAYOUT_RANGE tempRange(byteStart, byteLen, 0);
- ranges.push_back(tempRange);
- int64_t fileObjId = 0;
- if (addUnallocBlockFile(vsPart.objId, 0, tempRange.byteLen, ranges, fileObjId, m_curImgId) == TSK_ERR) {
+ const uint64_t byteLen = vsInfo->block_size * vsPart.len;
+ if (addUnallocBlockFileInChunks(byteStart, byteLen, vsPart.objId, m_curImgId) == TSK_ERR) {
registerError();
return TSK_ERR;
}
@@ -1954,13 +1966,61 @@ TSK_RETVAL_ENUM TskAutoDbJava::addUnallocImageSpaceToDb() {
vector<TSK_DB_FILE_LAYOUT_RANGE> ranges;
ranges.push_back(tempRange);
int64_t fileObjId = 0;
- if (TSK_ERR == addUnallocBlockFile(m_curImgId, 0, imgSize, ranges, fileObjId, m_curImgId)) {
+ if (TSK_ERR == addUnallocBlockFileInChunks(0, imgSize, m_curImgId, m_curImgId)) {
return TSK_ERR;
}
}
return TSK_OK;
}
+TSK_RETVAL_ENUM TskAutoDbJava::addUnallocBlockFileInChunks(uint64_t byteStart, TSK_OFF_T totalSize, int64_t parentObjId, int64_t dataSourceObjId) {
+
+ printf("\n###\nAdding unalloc file: parent: %lld, image: %lld, original start: 0x%llx, total size: 0x%llx \n",
+ parentObjId, dataSourceObjId, byteStart, totalSize);
+
+ if (m_maxChunkSize <= 0) {
+ // No chunking - write the entire file
+ TSK_DB_FILE_LAYOUT_RANGE tempRange(byteStart, totalSize, 0);
+ vector<TSK_DB_FILE_LAYOUT_RANGE> ranges;
+ ranges.push_back(tempRange);
+ int64_t fileObjId = 0;
+ return addUnallocBlockFile(parentObjId, 0, totalSize, ranges, fileObjId, dataSourceObjId);
+ }
+
+ // We will chunk into separate files with max size m_maxChunkSize
+ uint64_t maxChunkSize = (uint64_t)m_maxChunkSize;
+ uint64_t bytesLeft = (uint64_t)totalSize;
+ uint64_t startingOffset = byteStart;
+ uint64_t chunkSize;
+ vector<TSK_DB_FILE_LAYOUT_RANGE> ranges;
+ while (bytesLeft > 0) {
+
+ if (maxChunkSize > bytesLeft) {
+ chunkSize = bytesLeft;
+ bytesLeft = 0;
+ }
+ else {
+ chunkSize = maxChunkSize;
+ bytesLeft -= maxChunkSize;
+ }
+
+ TSK_DB_FILE_LAYOUT_RANGE tempRange(startingOffset, chunkSize, 0);
+ ranges.push_back(tempRange);
+ int64_t fileObjId = 0;
+
+ printf("Adding range starting at 0x%llx with size 0x%llx\n", startingOffset, chunkSize);
+ TSK_RETVAL_ENUM retval = addUnallocBlockFile(parentObjId, 0, chunkSize, ranges, fileObjId, dataSourceObjId);
+ if (retval != TSK_OK) {
+ printf("Error adding unalloc file: parent: %lld, image: %lld, original start: 0x%llx, total size: 0x%llx, range start: 0x%llx, range size: 0x%llx\n",
+ parentObjId, dataSourceObjId, byteStart, totalSize, startingOffset, chunkSize);
+ return retval;
+ }
+ ranges.clear();
+ startingOffset += chunkSize;
+ }
+ return TSK_OK;
+}
+
/**
* Returns the directory currently being analyzed by processFile().
* Safe to use from another thread than processFile().
diff --git a/bindings/java/jni/auto_db_java.h b/bindings/java/jni/auto_db_java.h
index b324a71c43445a88099b5901d061ce7c5e9a5812..6980a5dcfef1956c146a7259fd125f63af60e4be 100644
--- a/bindings/java/jni/auto_db_java.h
+++ b/bindings/java/jni/auto_db_java.h
@@ -205,6 +205,7 @@ class TskAutoDbJava :public TskAuto {
TSK_RETVAL_ENUM addUnallocVsSpaceToDb(size_t & numVsP);
TSK_RETVAL_ENUM addUnallocImageSpaceToDb();
TSK_RETVAL_ENUM addUnallocSpaceToDb();
+ TSK_RETVAL_ENUM addUnallocBlockFileInChunks(uint64_t byteStart, TSK_OFF_T totalSize, int64_t parentObjId, int64_t dataSourceObjId);
// JNI methods
TSK_RETVAL_ENUM addImageInfo(int type, TSK_OFF_T ssize, int64_t & objId, const string & timezone, TSK_OFF_T size, const string &md5,
diff --git a/tsk/auto/auto_db.cpp b/tsk/auto/auto_db.cpp
index 94fe1f60ed3af61015240221fbec4b9be15423b9..7e9ac85b8823655b764ad3d9cae2e217ed1525ca 100755
--- a/tsk/auto/auto_db.cpp
+++ b/tsk/auto/auto_db.cpp
@@ -380,27 +380,27 @@ TskAutoDb::addUnallocatedPoolBlocksToDb(size_t & numPool) {
/* Create the unallocated space files */
TSK_FS_ATTR_RUN * unalloc_runs = tsk_pool_unallocated_runs(pool_info);
TSK_FS_ATTR_RUN * current_run = unalloc_runs;
- //vector<TSK_DB_FILE_LAYOUT_RANGE> ranges;
+ vector<TSK_DB_FILE_LAYOUT_RANGE> ranges;
while (current_run != NULL) {
- if (addUnallocBlockFileInChunks(current_run->addr * pool_info->block_size, current_run->len * pool_info->block_size, unallocVolObjId, m_curImgId) == TSK_ERR) {
- registerError();
- tsk_fs_attr_run_free(unalloc_runs);
- return TSK_ERR;
- }
-
- //TSK_DB_FILE_LAYOUT_RANGE tempRange(current_run->addr * pool_info->block_size, current_run->len * pool_info->block_size, 0);
-
- //ranges.push_back(tempRange);
- //int64_t fileObjId = 0;
- //if (m_db->addUnallocBlockFile(unallocVolObjId, 0, current_run->len * pool_info->block_size, ranges, fileObjId, m_curImgId)) {
+ //if (addUnallocBlockFileInChunks(current_run->addr * pool_info->block_size, current_run->len * pool_info->block_size, unallocVolObjId, m_curImgId) == TSK_ERR) {
// registerError();
// tsk_fs_attr_run_free(unalloc_runs);
// return TSK_ERR;
//}
+ TSK_DB_FILE_LAYOUT_RANGE tempRange(current_run->addr * pool_info->block_size, current_run->len * pool_info->block_size, 0);
+
+ ranges.push_back(tempRange);
+ int64_t fileObjId = 0;
+ if (m_db->addUnallocBlockFile(unallocVolObjId, 0, current_run->len * pool_info->block_size, ranges, fileObjId, m_curImgId)) {
+ registerError();
+ tsk_fs_attr_run_free(unalloc_runs);
+ return TSK_ERR;
+ }
+
current_run = current_run->next;
- //ranges.clear();
+ ranges.clear();
}
tsk_fs_attr_run_free(unalloc_runs);
}
@@ -1335,7 +1335,7 @@ TSK_RETVAL_ENUM TskAutoDb::addUnallocVsSpaceToDb(size_t & numVsP) {
}
//create an unalloc file with unalloc part, with vs part as parent
- vector<TSK_DB_FILE_LAYOUT_RANGE> ranges;
+ //vector<TSK_DB_FILE_LAYOUT_RANGE> ranges;
const uint64_t byteStart = vsInfo.offset + vsInfo.block_size * vsPart.start;
const uint64_t byteLen = vsInfo.block_size * vsPart.len;
if (addUnallocBlockFileInChunks(byteStart, byteLen, vsPart.objId, m_curImgId) == TSK_ERR) {