Split all unallocated files if requested.

tsk/auto/auto_db.cpp

@@ -112,20 +112,23 @@ void TskAutoDb::setNoFatFsOrphans(bool noFatFsOrphans)
 void TskAutoDb::setAddUnallocSpace(bool addUnallocSpace)
 {
     setAddUnallocSpace(addUnallocSpace, -1);
+    m_maxChunkSize = (int64_t)512 * 1024 * 1024;
 }
 
 void TskAutoDb::setAddUnallocSpace(bool addUnallocSpace, int64_t minChunkSize)
 {
     m_addUnallocSpace = addUnallocSpace;
     m_minChunkSize = minChunkSize;
-    m_maxChunkSize = -1;
+    //m_maxChunkSize = -1;
+    m_maxChunkSize = (int64_t)512 * 1024 * 1024;
 }
 
 void TskAutoDb::setAddUnallocSpace(int64_t minChunkSize, int64_t maxChunkSize)
 {
     m_addUnallocSpace = true;
     m_minChunkSize = minChunkSize;
-    m_maxChunkSize = maxChunkSize;
+    //m_maxChunkSize = maxChunkSize;
+    m_maxChunkSize = (int64_t)512 * 1024 * 1024;
 }
 
 /**
@@ -377,21 +380,27 @@ TskAutoDb::addUnallocatedPoolBlocksToDb(size_t & numPool) {
         /* Create the unallocated space files */
         TSK_FS_ATTR_RUN * unalloc_runs = tsk_pool_unallocated_runs(pool_info);
         TSK_FS_ATTR_RUN * current_run = unalloc_runs;
-        vector<TSK_DB_FILE_LAYOUT_RANGE> ranges;
+        //vector<TSK_DB_FILE_LAYOUT_RANGE> ranges;
         while (current_run != NULL) {
 
-            TSK_DB_FILE_LAYOUT_RANGE tempRange(current_run->addr * pool_info->block_size, current_run->len * pool_info->block_size, 0);
-
-            ranges.push_back(tempRange);
-            int64_t fileObjId = 0;
-            if (m_db->addUnallocBlockFile(unallocVolObjId, 0, current_run->len * pool_info->block_size, ranges, fileObjId, m_curImgId)) {
+            if (addUnallocBlockFileInChunks(current_run->addr * pool_info->block_size, current_run->len * pool_info->block_size, unallocVolObjId, m_curImgId) == TSK_ERR) {
                 registerError();
                 tsk_fs_attr_run_free(unalloc_runs);
                 return TSK_ERR;
             }
 
+            //TSK_DB_FILE_LAYOUT_RANGE tempRange(current_run->addr * pool_info->block_size, current_run->len * pool_info->block_size, 0);
+
+            //ranges.push_back(tempRange);
+            //int64_t fileObjId = 0;
+            //if (m_db->addUnallocBlockFile(unallocVolObjId, 0, current_run->len * pool_info->block_size, ranges, fileObjId, m_curImgId)) {
+            //    registerError();
+            //    tsk_fs_attr_run_free(unalloc_runs);
+            //    return TSK_ERR;
+            //}
+
             current_run = current_run->next;
-            ranges.clear();
+            //ranges.clear();
         }
         tsk_fs_attr_run_free(unalloc_runs);
     }
@@ -1329,13 +1338,17 @@ TSK_RETVAL_ENUM TskAutoDb::addUnallocVsSpaceToDb(size_t & numVsP) {
         vector<TSK_DB_FILE_LAYOUT_RANGE> ranges;
         const uint64_t byteStart = vsInfo.offset + vsInfo.block_size * vsPart.start;
         const uint64_t byteLen = vsInfo.block_size * vsPart.len; 
-        TSK_DB_FILE_LAYOUT_RANGE tempRange(byteStart, byteLen, 0);
-        ranges.push_back(tempRange);
-        int64_t fileObjId = 0;
-        if (m_db->addUnallocBlockFile(vsPart.objId, 0, tempRange.byteLen, ranges, fileObjId, m_curImgId) == TSK_ERR) {
+        if (addUnallocBlockFileInChunks(byteStart, byteLen, vsPart.objId, m_curImgId) == TSK_ERR) {
             registerError();
             return TSK_ERR;
         }
+        //TSK_DB_FILE_LAYOUT_RANGE tempRange(byteStart, byteLen, 0);
+        //ranges.push_back(tempRange);
+        //int64_t fileObjId = 0;
+        //if (m_db->addUnallocBlockFile(vsPart.objId, 0, tempRange.byteLen, ranges, fileObjId, m_curImgId) == TSK_ERR) {
+        //    registerError();
+        //    return TSK_ERR;
+        //}
     }
 
     return TSK_OK;
@@ -1357,14 +1370,63 @@ TSK_RETVAL_ENUM TskAutoDb::addUnallocImageSpaceToDb() {
         retImgFile = TSK_ERR;
     }
     else {
-        TSK_DB_FILE_LAYOUT_RANGE tempRange(0, imgSize, 0);
+        //TSK_DB_FILE_LAYOUT_RANGE tempRange(0, imgSize, 0);
         //add unalloc block file for the entire image
+        //vector<TSK_DB_FILE_LAYOUT_RANGE> ranges;
+        //ranges.push_back(tempRange);
+        //int64_t fileObjId = 0;
+        //retImgFile = m_db->addUnallocBlockFile(m_curImgId, 0, imgSize, ranges, fileObjId, m_curImgId);
+        retImgFile = addUnallocBlockFileInChunks(0, imgSize, m_curImgId, m_curImgId);
+    }
+    return retImgFile;
+}
+
+TSK_RETVAL_ENUM TskAutoDb::addUnallocBlockFileInChunks(uint64_t byteStart, TSK_OFF_T totalSize, int64_t parentObjId, int64_t dataSourceObjId) {
+
+    printf("\n###\nAdding unalloc file: parent: %lld, image: %lld, original start: 0x%llx, total size: 0x%llx \n",
+        parentObjId, dataSourceObjId, byteStart, totalSize);
+
+    if (m_maxChunkSize <= 0) {
+        // No chunking - write the entire file
+        TSK_DB_FILE_LAYOUT_RANGE tempRange(byteStart, totalSize, 0);
         vector<TSK_DB_FILE_LAYOUT_RANGE> ranges;
         ranges.push_back(tempRange);
         int64_t fileObjId = 0;
-        retImgFile = m_db->addUnallocBlockFile(m_curImgId, 0, imgSize, ranges, fileObjId, m_curImgId);
+        return m_db->addUnallocBlockFile(parentObjId, 0, totalSize, ranges, fileObjId, dataSourceObjId);
     }
-    return retImgFile;
+
+    // We will chunk into separate files with max size m_maxChunkSize
+    uint64_t maxChunkSize = (uint64_t)m_maxChunkSize;
+    uint64_t bytesLeft = (uint64_t)totalSize;
+    uint64_t startingOffset = byteStart;
+    uint64_t chunkSize;
+    vector<TSK_DB_FILE_LAYOUT_RANGE> ranges;
+    while (bytesLeft > 0) {
+
+        if (maxChunkSize > bytesLeft) {
+            chunkSize = bytesLeft;
+            bytesLeft = 0;
+        }
+        else {
+            chunkSize = maxChunkSize;
+            bytesLeft -= maxChunkSize;
+        }
+
+        TSK_DB_FILE_LAYOUT_RANGE tempRange(startingOffset, chunkSize, 0);     
+        ranges.push_back(tempRange);
+        int64_t fileObjId = 0;
+
+        printf("Adding range starting at 0x%llx with size 0x%llx\n", startingOffset, chunkSize);
+        TSK_RETVAL_ENUM retval = m_db->addUnallocBlockFile(parentObjId, 0, chunkSize, ranges, fileObjId, dataSourceObjId);
+        if (retval != TSK_OK) {
+            printf("Error adding unalloc file: parent: %lld, image: %lld, original start: 0x%llx, total size: 0x%llx, range start: 0x%llx, range size: 0x%llx\n", 
+                parentObjId, dataSourceObjId, byteStart, totalSize, startingOffset, chunkSize);
+            return retval;
+        }
+        ranges.clear();
+        startingOffset += chunkSize;
+    }
+    return TSK_OK;
 }
 
 /**

tsk/auto/tsk_case_db.h

@@ -198,6 +198,7 @@ class TskAutoDb:public TskAuto {
     TSK_RETVAL_ENUM addUnallocVsSpaceToDb(size_t & numVsP);
     TSK_RETVAL_ENUM addUnallocImageSpaceToDb();
     TSK_RETVAL_ENUM addUnallocSpaceToDb();
+    TSK_RETVAL_ENUM addUnallocBlockFileInChunks(uint64_t byteStart, TSK_OFF_T totalSize, int64_t parentObjId, int64_t dataSourceObjId);
 
 };