/// <summary> /// Get the bytes of the chunk that contains a specified offset. /// </summary> /// <param name="start">The position in the stream for which bytes are wanted.</param> /// <param name="currentChunkIndex">Stores the index of the chunk.</param> /// <returns>byte array containing the bytes of the chunk.</returns> private byte[] getChunk(long start, out int currentChunkIndex) { currentChunkIndex = mapRequestToChunkInfo(start, out _currentChunkPointer); byte[] buff = new byte[_chunkInfos[currentChunkIndex].BytesInChunk]; byte[] emulatedBytes = new byte[_bytesPerChunk]; using (FileStream fs = File.OpenRead(Files[_chunkInfos[currentChunkIndex].FileIndex])) { fs.Seek(_chunkInfos[currentChunkIndex].FileOffset, SeekOrigin.Begin); fs.Read(buff, 0, _chunkInfos[currentChunkIndex].BytesInChunk); if (_chunkInfos[_currentChunkIndex].IsCompressed) // If compressed... { using (MemoryStream ms = new MemoryStream(buff, false)) // ...decompress... { DiscUtils.Compression.ZlibStream zlib = new Compression.ZlibStream(ms, System.IO.Compression.CompressionMode.Decompress, true); zlib.Read(emulatedBytes, 0, _bytesPerChunk); } } else // ...no need. { emulatedBytes = buff; } } return(emulatedBytes); // decompressed (or not) bytes }
/// <summary> /// <para>Represents the Header2 section of the EWF file.</para> /// <para>Holds various meta-data about the acquisition.</para> /// </summary> /// <param name="bytes">The bytes that make up the Header2 section.</param> public Header2(byte[] bytes) { string header = null; // Will eventually hold the decompressed Header2 info #region Decompress zlib'd data { byte[] buff = new byte[1024]; using (System.IO.MemoryStream ms = new System.IO.MemoryStream(bytes)) { using (Compression.ZlibStream zs = new Compression.ZlibStream(ms, System.IO.Compression.CompressionMode.Decompress, false)) { using (System.IO.MemoryStream decomp = new System.IO.MemoryStream()) { int n; while ((n = zs.Read(buff, 0, buff.Length)) != 0) { decomp.Write(buff, 0, n); } decomp.Seek(0, System.IO.SeekOrigin.Begin); System.IO.StreamReader sr = new System.IO.StreamReader(decomp, System.Text.Encoding.UTF8); header = sr.ReadToEnd(); } } } } #endregion string[] parts = header.Split(new char[] { (char)0x0A }); int catsCount = int.Parse(parts[0]); Categories = new List<Header2Category>(catsCount); if (catsCount == 1) // EnCase 4 { for (int i = 0; i < parts.Length; i++) // Header seems to have 0x0A on the end parts[i] = parts[i].TrimEnd('\r'); if (parts[1] != "main") throw new ArgumentException(string.Format("unexpected category: {0}", parts[1])); Categories.Add(new Header2Category("main", parts[2], parts[3])); } else if (catsCount == 3) // EnCase 5-7 { if (parts[1] != "main") throw new ArgumentException(string.Format("unexpected category: {0}", parts[1])); Categories.Add(new Header2Category("main", parts[2], parts[3])); if (parts[5] != "srce") throw new ArgumentException(string.Format("unexpected category: {0}", parts[5])); Categories.Add(new Header2Category("srce", parts[7], parts[9])); if (parts[11] != "sub") throw new ArgumentException(string.Format("unexpected category: {0}", parts[13])); Categories.Add(new Header2Category("sub", parts[13], parts[15])); } else { throw new ArgumentException(string.Format("unknown category layout ({0} categories)", catsCount)); } }
/// <summary> /// <para>Represents the Header2 section of the EWF file.</para> /// <para>Holds various meta-data about the acquisition.</para> /// </summary> /// <param name="bytes">The bytes that make up the Header2 section.</param> public Header2(byte[] bytes) { string header = null; // Will eventually hold the decompressed Header2 info #region Decompress zlib'd data { byte[] buff = new byte[1024]; using (System.IO.MemoryStream ms = new System.IO.MemoryStream(bytes)) { using (Compression.ZlibStream zs = new Compression.ZlibStream(ms, System.IO.Compression.CompressionMode.Decompress, false)) { using (System.IO.MemoryStream decomp = new System.IO.MemoryStream()) { int n; while ((n = zs.Read(buff, 0, buff.Length)) != 0) { decomp.Write(buff, 0, n); } decomp.Seek(0, System.IO.SeekOrigin.Begin); System.IO.StreamReader sr = new System.IO.StreamReader(decomp, System.Text.Encoding.UTF8); header = sr.ReadToEnd(); } } } } #endregion string[] parts = header.Split(new char[] { (char)0x0A }); int catsCount = int.Parse(parts[0]); Categories = new List <Header2Category>(catsCount); if (catsCount == 1) // EnCase 4 { for (int i = 0; i < parts.Length; i++) // Header seems to have 0x0A on the end { parts[i] = parts[i].TrimEnd('\r'); } if (parts[1] != "main") { throw new ArgumentException(string.Format("unexpected category: {0}", parts[1])); } Categories.Add(new Header2Category("main", parts[2], parts[3])); } else if (catsCount == 3) // EnCase 5-7 { if (parts[1] != "main") { throw new ArgumentException(string.Format("unexpected category: {0}", parts[1])); } Categories.Add(new Header2Category("main", parts[2], parts[3])); if (parts[5] != "srce") { throw new ArgumentException(string.Format("unexpected category: {0}", parts[5])); } Categories.Add(new Header2Category("srce", parts[7], parts[9])); if (parts[11] != "sub") { throw new ArgumentException(string.Format("unexpected category: {0}", parts[13])); } Categories.Add(new Header2Category("sub", parts[13], parts[15])); } else { throw new ArgumentException(string.Format("unknown category layout ({0} categories)", catsCount)); } }