diff --git a/tsk/auto/auto.cpp b/tsk/auto/auto.cpp index cfca4556258c7abe79c4ce5c316917e437b6a57d..43f2ad9261d580632ab3dd1aaf42502b72b3f15f 100755 --- a/tsk/auto/auto.cpp +++ b/tsk/auto/auto.cpp @@ -38,6 +38,7 @@ TskAuto::TskAuto() TskAuto::~TskAuto() { closeImage(); + m_exteralFsInfoList.clear(); // Don't close the file systems that were passed in m_tag = 0; } @@ -183,6 +184,17 @@ void m_fileFilterFlags = file_flags; } +/** + * Store a list of pointers to open file systems to use when calling findFilesInImg + * instead of opening a new copy. + */ +void +TskAuto::setExternalFileSystemList(std::list<TSK_FS_INFO *> fsInfoList) +{ + m_exteralFsInfoList.resize(fsInfoList.size()); + m_exteralFsInfoList.assign(fsInfoList.begin(), fsInfoList.end()); +} + /** * @return The size of the image in bytes or -1 if the * image is not open. @@ -550,6 +562,18 @@ TSK_RETVAL_ENUM return TSK_ERR; } + // If we already have an open copy of this file system, use it + for (auto itr = m_exteralFsInfoList.begin(); itr != m_exteralFsInfoList.end(); itr++) { + if ((*itr)->offset == a_start) { + TSK_FS_INFO *fs_info = *itr; + TSK_RETVAL_ENUM retval = findFilesInFsInt(fs_info, fs_info->root_inum); + if (m_errors.empty() == false) + return TSK_ERR; + else + return retval; + } + } + TSK_FS_INFO *fs_info; if ((fs_info = tsk_fs_open_img(m_img_info, a_start, a_ftype)) == NULL) { if (isCurVsValid() == false) { diff --git a/tsk/auto/tsk_auto.h b/tsk/auto/tsk_auto.h index 028a95d82b7a37ced4054ffb3c2ec9bdbd4afe50..c9f1d9a3a747ef9cb8da809ddc59ef35d8817be3 100644 --- a/tsk/auto/tsk_auto.h +++ b/tsk/auto/tsk_auto.h @@ -34,7 +34,7 @@ #include <string> #include <vector> - +#include <list> #define TSK_AUTO_TAG 0x9191ABAB @@ -100,6 +100,7 @@ class TskAuto { void setFileFilterFlags(TSK_FS_DIR_WALK_FLAG_ENUM); void setVolFilterFlags(TSK_VS_PART_FLAG_ENUM); + void setExternalFileSystemList(std::list<TSK_FS_INFO *> exteralFsInfoList); /** * TskAuto calls this method before it processes the volume system that is found in an @@ -264,6 +265,7 @@ class TskAuto { protected: TSK_IMG_INFO * m_img_info; std::vector<const TSK_POOL_INFO*> m_poolInfos; + std::list<TSK_FS_INFO *> m_exteralFsInfoList; // Stores TSK_FS_INFO structures that were opened outside of TskAuto and passed in bool m_internalOpen; ///< True if m_img_info was opened in TskAuto and false if passed in bool m_stopAllProcessing; ///< True if no further processing should occur