1 /*
2  * The Sleuth Kit
3  *
4  * Contact: Brian Carrier [carrier <at> sleuthkit [dot] org]
5  * Copyright (c) 2010-2012 Basis Technology Corporation. All Rights
6  * reserved.
7  *
8  * This software is distributed under the Common Public License 1.0
9  */
10 
11 /**
12  * \file TskFile.h
13  * Contains the interface for the TskFile class.
14  */
15 
16 #ifndef _TSK_FILE_TSK_H
17 #define _TSK_FILE_TSK_H
18 
19 // System includes
20 #include <string>
21 
22 // Framework includes
23 #include "TskFile.h"
24 #include "tsk/framework/services/TskImgDB.h"
25 #include "tsk/base/tsk_os.h"
26 
27 // Poco includes
28 #include "Poco/File.h"
29 #include "Poco/FileStream.h"
30 
31 /**
32  * TskFileTsk is a Sleuthkit and Poco based implementation
33  * of the TskFile interface.
34  */
35 class TSK_FRAMEWORK_API TskFileTsk : public TskFile
36 {
37 public:
38 
39 
40 	virtual ~TskFileTsk();
41 
42     /// Fully qualified path to on-disk representation of file.
43     virtual std::string getPath() const;
44 
45     /// Does a file exist on disk for this TskFile object.
46     /**
47      * @return True if a file exists, false otherwise
48      */
49     virtual bool exists() const;
50 
51     /// Does this file represent a directory.
52     /**
53      * @return True if this is a directory, false otherwise
54      */
55     virtual bool isDirectory() const;
56 
57     /// Is this a Sleuthkit "virtual" file (created by TSK for
58     /// file system areas).
59     /**
60      * @return True if this is a "virtual" file, false otherwise
61      */
62     virtual bool isVirtual() const;
63 
64     /// Open the file. Must be called before reading.
65     virtual void open();
66 
67     /// Close the file.
68     virtual void close();
69 
70     virtual TSK_OFF_T tell() const;
71 
72     virtual TSK_OFF_T seek(const TSK_OFF_T off, std::ios::seekdir origin = std::ios::beg);
73 
74     virtual ssize_t read(char * buf, const size_t count);
75 
76 protected:
77     friend class TskFileManagerImpl;
78 
79     // Construct a file for the given id.
80 	TskFileTsk(const uint64_t id);
81 
TskFileTsk()82     TskFileTsk() {};
83 
84     // A handle to the file on disk
85     Poco::File m_file;
86 
87     // An input stream for the file on disk
88     Poco::FileInputStream * m_fileInStream;
89 
90     // A Sleuthkit handle to the file in an image
91     int m_handle;
92 
93     // For IMGDB_FILES_TYPE_UNUSED unused_sectors only
94     TskUnusedSectorsRecord m_unusedSectorsRecord;
95 };
96 #endif
97