1 /* 2 * The Sleuth Kit 3 * 4 * Contact: Brian Carrier [carrier <at> sleuthkit [dot] org] 5 * Copyright (c) 2010-2012 Basis Technology Corporation. All Rights 6 * reserved. 7 * 8 * This software is distributed under the Common Public License 1.0 9 */ 10 11 /** 12 * \file TskFile.h 13 * Contains the interface for the TskFile class. 14 */ 15 16 #ifndef _TSK_FILE_TSK_H 17 #define _TSK_FILE_TSK_H 18 19 // System includes 20 #include <string> 21 22 // Framework includes 23 #include "TskFile.h" 24 #include "tsk/framework/services/TskImgDB.h" 25 #include "tsk/base/tsk_os.h" 26 27 // Poco includes 28 #include "Poco/File.h" 29 #include "Poco/FileStream.h" 30 31 /** 32 * TskFileTsk is a Sleuthkit and Poco based implementation 33 * of the TskFile interface. 34 */ 35 class TSK_FRAMEWORK_API TskFileTsk : public TskFile 36 { 37 public: 38 39 40 virtual ~TskFileTsk(); 41 42 /// Fully qualified path to on-disk representation of file. 43 virtual std::string getPath() const; 44 45 /// Does a file exist on disk for this TskFile object. 46 /** 47 * @return True if a file exists, false otherwise 48 */ 49 virtual bool exists() const; 50 51 /// Does this file represent a directory. 52 /** 53 * @return True if this is a directory, false otherwise 54 */ 55 virtual bool isDirectory() const; 56 57 /// Is this a Sleuthkit "virtual" file (created by TSK for 58 /// file system areas). 59 /** 60 * @return True if this is a "virtual" file, false otherwise 61 */ 62 virtual bool isVirtual() const; 63 64 /// Open the file. Must be called before reading. 65 virtual void open(); 66 67 /// Close the file. 68 virtual void close(); 69 70 virtual TSK_OFF_T tell() const; 71 72 virtual TSK_OFF_T seek(const TSK_OFF_T off, std::ios::seekdir origin = std::ios::beg); 73 74 virtual ssize_t read(char * buf, const size_t count); 75 76 protected: 77 friend class TskFileManagerImpl; 78 79 // Construct a file for the given id. 80 TskFileTsk(const uint64_t id); 81 TskFileTsk()82 TskFileTsk() {}; 83 84 // A handle to the file on disk 85 Poco::File m_file; 86 87 // An input stream for the file on disk 88 Poco::FileInputStream * m_fileInStream; 89 90 // A Sleuthkit handle to the file in an image 91 int m_handle; 92 93 // For IMGDB_FILES_TYPE_UNUSED unused_sectors only 94 TskUnusedSectorsRecord m_unusedSectorsRecord; 95 }; 96 #endif 97