diff --git a/tsk/auto/auto_db.cpp b/tsk/auto/auto_db.cpp old mode 100644 new mode 100755 index 6b9660612e877658632df65d6bb8866ab99a0c6f..01a3caa4dd4aaa137d1f67df4c0240e64c857364 --- a/tsk/auto/auto_db.cpp +++ b/tsk/auto/auto_db.cpp @@ -208,6 +208,7 @@ uint8_t TskAutoDb::addImageDetails(const char* deviceId) { string md5 = ""; + string sha1 = ""; #if HAVE_LIBEWF if (m_img_info->itype == TSK_IMG_TYPE_EWF_EWF) { // @@@ This should really probably be inside of a tsk_img_ method @@ -215,6 +216,9 @@ TskAutoDb::addImageDetails(const char* deviceId) if (ewf_info->md5hash_isset) { md5 = ewf_info->md5hash; } + if (ewf_info->sha1hash_isset) { + sha1 = ewf_info->sha1hash; + } } #endif @@ -225,7 +229,7 @@ TskAutoDb::addImageDetails(const char* deviceId) devId = ""; } if (m_db->addImageInfo(m_img_info->itype, m_img_info->sector_size, - m_curImgId, m_curImgTZone, m_img_info->size, md5, "", "", devId)) { + m_curImgId, m_curImgTZone, m_img_info->size, md5, sha1, "", devId)) { registerError(); return 1; } diff --git a/tsk/img/ewf.c b/tsk/img/ewf.c old mode 100644 new mode 100755 index 322f285fcd7fbbe9abf38e112302ef6bd2751c48..fa3876bcd6650da4f222957ea9bccbb887efd212 --- a/tsk/img/ewf.c +++ b/tsk/img/ewf.c @@ -406,6 +406,29 @@ ewf_open(int a_num_img, } ewf_info->md5hash_isset = result; + int sha1_result = libewf_handle_get_hash_value_sha1(ewf_info->handle, + (uint8_t *)ewf_info->sha1hash, 41, &ewf_error); + + if (sha1_result == -1) { + tsk_error_reset(); + tsk_error_set_errno(TSK_ERR_IMG_OPEN); + + getError(ewf_error, error_string); + tsk_error_set_errstr("ewf_open file: %" PRIttocTSK + ": Error getting MD5 of image (%s)", a_images[0], + error_string); + libewf_error_free(&ewf_error); + + tsk_img_free(ewf_info); + + if (tsk_verbose != 0) { + tsk_fprintf(stderr, "Error getting size of EWF file\n"); + } + return (NULL); + } + ewf_info->sha1hash_isset = result; + + #else // V1 API // Check the file signature before we call the library open diff --git a/tsk/img/ewf.h b/tsk/img/ewf.h old mode 100644 new mode 100755 index 08752e14e1e91ce04f858ae092695a084c8d284d..7b64c24236a8e74ee64615ff25631c6a35bacf25 --- a/tsk/img/ewf.h +++ b/tsk/img/ewf.h @@ -38,6 +38,8 @@ extern "C" { libewf_handle_t *handle; char md5hash[33]; int md5hash_isset; + char sha1hash[41]; + int sha1hash_isset; uint8_t used_ewf_glob; // 1 if libewf_glob was used during open tsk_lock_t read_lock; ///< Lock for reads since libewf is not thread safe -- only works if you have a single instance of EWF_INFO for all threads. } IMG_EWF_INFO;