/// <summary> /// Initializes sleuthkit with the specified image files (calls tsk_img_open_* methods) /// </summary> /// <param name="_files"></param> private void Init(IEnumerable <FileInfo> _files) { if (_files == null) { throw new ArgumentException("file must not be null."); } if (_files.Any(_ => !_.Exists)) { throw new ArgumentException("file must exist, cant just be a bogus path."); } this.files = _files.ToArray(); var count = files.Length; if (count == 1) { this._handle = NativeMethods.tsk_img_open_sing(this.files[0].FullName, 0, 0); } else { var image_files_array = new IntPtr[this.files.Count()]; // Each IntPtr array element will point to a copy of a // string element in the openFileDialog.FileNames array. // based on answered provided in this link - http://stackoverflow.com/questions/8838455/how-to-convert-c-sharp-string-to-system-intptr for (int i = 0; i < this.files.Count(); i++) { image_files_array[i] = Marshal.StringToCoTaskMemUni(this.files[i].FullName); } this._handle = NativeMethods.tsk_img_open(this.files.Count(), image_files_array, 0, 0); } if (!this._handle.IsInvalid) { this._struct = this._handle.GetStruct(); } else { throw new InvalidOperationException("tsk_img_open didnt work right."); } }
internal static extern FileSystemHandle tsk_fs_open_img(DiskImageHandle image, long offset, FileSystemType fstype);
internal static extern VolumeSystemHandle tsk_vs_open(DiskImageHandle image, long offset, VolumeSystemType type);
internal static extern int tsk_img_read(DiskImageHandle img, long a_off, byte[] buf, int len);