diff --git a/tsk/auto/auto_db.cpp b/tsk/auto/auto_db.cpp
index 0265c72c04e7b646ec9436f2913b447658167f12..94fe1f60ed3af61015240221fbec4b9be15423b9 100755
--- a/tsk/auto/auto_db.cpp
+++ b/tsk/auto/auto_db.cpp
@@ -112,20 +112,23 @@ void TskAutoDb::setNoFatFsOrphans(bool noFatFsOrphans)
void TskAutoDb::setAddUnallocSpace(bool addUnallocSpace)
{
setAddUnallocSpace(addUnallocSpace, -1);
+ m_maxChunkSize = (int64_t)512 * 1024 * 1024;
}
void TskAutoDb::setAddUnallocSpace(bool addUnallocSpace, int64_t minChunkSize)
{
m_addUnallocSpace = addUnallocSpace;
m_minChunkSize = minChunkSize;
- m_maxChunkSize = -1;
+ //m_maxChunkSize = -1;
+ m_maxChunkSize = (int64_t)512 * 1024 * 1024;
}
void TskAutoDb::setAddUnallocSpace(int64_t minChunkSize, int64_t maxChunkSize)
{
m_addUnallocSpace = true;
m_minChunkSize = minChunkSize;
- m_maxChunkSize = maxChunkSize;
+ //m_maxChunkSize = maxChunkSize;
+ m_maxChunkSize = (int64_t)512 * 1024 * 1024;
}
/**
@@ -377,21 +380,27 @@ TskAutoDb::addUnallocatedPoolBlocksToDb(size_t & numPool) {
/* Create the unallocated space files */
TSK_FS_ATTR_RUN * unalloc_runs = tsk_pool_unallocated_runs(pool_info);
TSK_FS_ATTR_RUN * current_run = unalloc_runs;
- vector<TSK_DB_FILE_LAYOUT_RANGE> ranges;
+ //vector<TSK_DB_FILE_LAYOUT_RANGE> ranges;
while (current_run != NULL) {
- TSK_DB_FILE_LAYOUT_RANGE tempRange(current_run->addr * pool_info->block_size, current_run->len * pool_info->block_size, 0);
-
- ranges.push_back(tempRange);
- int64_t fileObjId = 0;
- if (m_db->addUnallocBlockFile(unallocVolObjId, 0, current_run->len * pool_info->block_size, ranges, fileObjId, m_curImgId)) {
+ if (addUnallocBlockFileInChunks(current_run->addr * pool_info->block_size, current_run->len * pool_info->block_size, unallocVolObjId, m_curImgId) == TSK_ERR) {
registerError();
tsk_fs_attr_run_free(unalloc_runs);
return TSK_ERR;
}
+ //TSK_DB_FILE_LAYOUT_RANGE tempRange(current_run->addr * pool_info->block_size, current_run->len * pool_info->block_size, 0);
+
+ //ranges.push_back(tempRange);
+ //int64_t fileObjId = 0;
+ //if (m_db->addUnallocBlockFile(unallocVolObjId, 0, current_run->len * pool_info->block_size, ranges, fileObjId, m_curImgId)) {
+ // registerError();
+ // tsk_fs_attr_run_free(unalloc_runs);
+ // return TSK_ERR;
+ //}
+
current_run = current_run->next;
- ranges.clear();
+ //ranges.clear();
}
tsk_fs_attr_run_free(unalloc_runs);
}
@@ -1329,13 +1338,17 @@ TSK_RETVAL_ENUM TskAutoDb::addUnallocVsSpaceToDb(size_t & numVsP) {
vector<TSK_DB_FILE_LAYOUT_RANGE> ranges;
const uint64_t byteStart = vsInfo.offset + vsInfo.block_size * vsPart.start;
const uint64_t byteLen = vsInfo.block_size * vsPart.len;
- TSK_DB_FILE_LAYOUT_RANGE tempRange(byteStart, byteLen, 0);
- ranges.push_back(tempRange);
- int64_t fileObjId = 0;
- if (m_db->addUnallocBlockFile(vsPart.objId, 0, tempRange.byteLen, ranges, fileObjId, m_curImgId) == TSK_ERR) {
+ if (addUnallocBlockFileInChunks(byteStart, byteLen, vsPart.objId, m_curImgId) == TSK_ERR) {
registerError();
return TSK_ERR;
}
+ //TSK_DB_FILE_LAYOUT_RANGE tempRange(byteStart, byteLen, 0);
+ //ranges.push_back(tempRange);
+ //int64_t fileObjId = 0;
+ //if (m_db->addUnallocBlockFile(vsPart.objId, 0, tempRange.byteLen, ranges, fileObjId, m_curImgId) == TSK_ERR) {
+ // registerError();
+ // return TSK_ERR;
+ //}
}
return TSK_OK;
@@ -1357,14 +1370,63 @@ TSK_RETVAL_ENUM TskAutoDb::addUnallocImageSpaceToDb() {
retImgFile = TSK_ERR;
}
else {
- TSK_DB_FILE_LAYOUT_RANGE tempRange(0, imgSize, 0);
+ //TSK_DB_FILE_LAYOUT_RANGE tempRange(0, imgSize, 0);
//add unalloc block file for the entire image
+ //vector<TSK_DB_FILE_LAYOUT_RANGE> ranges;
+ //ranges.push_back(tempRange);
+ //int64_t fileObjId = 0;
+ //retImgFile = m_db->addUnallocBlockFile(m_curImgId, 0, imgSize, ranges, fileObjId, m_curImgId);
+ retImgFile = addUnallocBlockFileInChunks(0, imgSize, m_curImgId, m_curImgId);
+ }
+ return retImgFile;
+}
+
+TSK_RETVAL_ENUM TskAutoDb::addUnallocBlockFileInChunks(uint64_t byteStart, TSK_OFF_T totalSize, int64_t parentObjId, int64_t dataSourceObjId) {
+
+ printf("\n###\nAdding unalloc file: parent: %lld, image: %lld, original start: 0x%llx, total size: 0x%llx \n",
+ parentObjId, dataSourceObjId, byteStart, totalSize);
+
+ if (m_maxChunkSize <= 0) {
+ // No chunking - write the entire file
+ TSK_DB_FILE_LAYOUT_RANGE tempRange(byteStart, totalSize, 0);
vector<TSK_DB_FILE_LAYOUT_RANGE> ranges;
ranges.push_back(tempRange);
int64_t fileObjId = 0;
- retImgFile = m_db->addUnallocBlockFile(m_curImgId, 0, imgSize, ranges, fileObjId, m_curImgId);
+ return m_db->addUnallocBlockFile(parentObjId, 0, totalSize, ranges, fileObjId, dataSourceObjId);
}
- return retImgFile;
+
+ // We will chunk into separate files with max size m_maxChunkSize
+ uint64_t maxChunkSize = (uint64_t)m_maxChunkSize;
+ uint64_t bytesLeft = (uint64_t)totalSize;
+ uint64_t startingOffset = byteStart;
+ uint64_t chunkSize;
+ vector<TSK_DB_FILE_LAYOUT_RANGE> ranges;
+ while (bytesLeft > 0) {
+
+ if (maxChunkSize > bytesLeft) {
+ chunkSize = bytesLeft;
+ bytesLeft = 0;
+ }
+ else {
+ chunkSize = maxChunkSize;
+ bytesLeft -= maxChunkSize;
+ }
+
+ TSK_DB_FILE_LAYOUT_RANGE tempRange(startingOffset, chunkSize, 0);
+ ranges.push_back(tempRange);
+ int64_t fileObjId = 0;
+
+ printf("Adding range starting at 0x%llx with size 0x%llx\n", startingOffset, chunkSize);
+ TSK_RETVAL_ENUM retval = m_db->addUnallocBlockFile(parentObjId, 0, chunkSize, ranges, fileObjId, dataSourceObjId);
+ if (retval != TSK_OK) {
+ printf("Error adding unalloc file: parent: %lld, image: %lld, original start: 0x%llx, total size: 0x%llx, range start: 0x%llx, range size: 0x%llx\n",
+ parentObjId, dataSourceObjId, byteStart, totalSize, startingOffset, chunkSize);
+ return retval;
+ }
+ ranges.clear();
+ startingOffset += chunkSize;
+ }
+ return TSK_OK;
}
/**
diff --git a/tsk/auto/tsk_case_db.h b/tsk/auto/tsk_case_db.h
index fb6bc765644125dd5445e1a437782c7c9b3374de..4b29e156e68360371d212f111be9b21eb22e8b3a 100644
--- a/tsk/auto/tsk_case_db.h
+++ b/tsk/auto/tsk_case_db.h
@@ -198,6 +198,7 @@ class TskAutoDb:public TskAuto {
TSK_RETVAL_ENUM addUnallocVsSpaceToDb(size_t & numVsP);
TSK_RETVAL_ENUM addUnallocImageSpaceToDb();
TSK_RETVAL_ENUM addUnallocSpaceToDb();
+ TSK_RETVAL_ENUM addUnallocBlockFileInChunks(uint64_t byteStart, TSK_OFF_T totalSize, int64_t parentObjId, int64_t dataSourceObjId);
};