コード例 #1
0
ファイル: NoFilter.cs プロジェクト: bixiu/DEC0DE-forensics
        public FilterResult Filter()
        {
            int count = 0;
            var fileInfo = new FileInfo(_imagePath);
            var blocks = new List<Block>();

            while(count < fileInfo.Length)
            {
                int newLength = Math.Min(_blockSize, Convert.ToInt32(fileInfo.Length - count));

                var block = new Block() { Length = newLength, OffsetFile = count };
                blocks.Add(block);

                count += newLength;

            }

            var result = new FilterResult() {UnfilteredBlocks = blocks};

            return result;
        }
コード例 #2
0
 private ViterbiResult RunMetaViterbi(ViterbiResult viterbiResultFields, List<MetaField> addressBookEntries, List<MetaField> callLogs, List<MetaField> sms)
 {
     ViterbiResult viterbiResultRecord = null;
     try
     {
         if (viterbiResultFields != null)
         {
             write("Running Viterbi on records");
             DateTime dt = DateTime.Now;
             metaResults = CreateMetaInfo(viterbiResultFields.Fields);
             Block block = new Block()
             {
                 Bytes = metaResults.Select(r => (byte)r.Name).ToArray(),
                 OffsetFile = 0
             };
             var blockList = new List<Block> { block };
             List<UserState> user_state = new List<UserState>();
             ThreadedViterbi tv = new ThreadedViterbi(blockList, RunType.Meta, user_state, this.filePath, this.fileSha1);
             viterbiResultRecord = tv.RunThreadedViterbi();
     #if false
             TextWriter tw = null;
             try {
                 if (viterbiResultRecord == null) throw new Exception("No results");
                 tw = new StreamWriter(Path.Combine(@"C:\temp", String.Format("Records_{0}.csv", DateTime.Now.ToString("yyyyMMdd_HHmm"))));
                 foreach (ViterbiField f in viterbiResultRecord.Fields) {
                     tw.WriteLine("{0}\t{1}\t{2}", f.OffsetFile, f.FieldString, f.MachineName.ToString());
                 }
             } catch (Exception ex) {
             } finally {
                 if (tw != null) tw.Close();
             }
     #endif
             TimeSpan ts = DateTime.Now.Subtract(dt);
             write("Time elapsed for Viterbi records: {0}", ts.ToString("c"));
             InterpretResults(metaResults, viterbiResultRecord, addressBookEntries, callLogs, sms);
             write("Entries: call log = {0}, address book = {1}, sms = {2}", callLogs.Count,
                   addressBookEntries.Count,
                   sms.Count);
         }
     }
     catch (ThreadAbortException)
     {
         return null;
     }
     catch (Exception ex)
     {
         DisplayExceptionMessages(ex, "Viterbi Records");
         return null;
     }
     return viterbiResultRecord;
 }
コード例 #3
0
 private List<Block> Split_On_Binary_Large_Fields(byte[] bytes)
 {
     List<Block> blocks = new List<Block>();
     List<byte> tmp = new List<byte>();
     for (int j = 0; j < bytes.Length; j++)
     {
         if (bytes[j] == (byte)MetaMachine.BinaryLarge)
         {
             tmp.Add(bytes[j]);
             if (tmp.Count != 1)
             {
                 Block block = new Block();
                 block.Bytes = new byte[tmp.Count];
                 tmp.ToArray().CopyTo(block.Bytes, 0);                        
                 blocks.Add(block);
                 tmp.Clear();
             }
         }
         else
         {
             tmp.Add(bytes[j]);
         }
     }
     tmp.Add((byte)MetaMachine.BinaryLarge);
     Block b = new Block();
     b.Bytes = new byte[tmp.Count];            
     tmp.ToArray().CopyTo(b.Bytes, 0);
     blocks.Add(b);
     
     blocks[0].OffsetFile = 0;
     for (int j = 1; j < blocks.Count; j++)
     {
         blocks[j].OffsetFile = blocks[j - 1].OffsetFile + blocks[j - 1].Bytes.Length;
     }
     return blocks;
 }
コード例 #4
0
        public void RunMetaViterbi(int parseId, List<ViterbiField> viterbiFields)
        {
            var metaResults = CreateMetaInfo(viterbiFields);

            var block = new Block() { Bytes = metaResults.Select(r => (byte)r.Name).ToArray(), OffsetFile = 0 };

            var blockList = new List<Block> { block };

            var viterbiResult = RunViterbi(blockList, RunType.Meta);

            var addressBookEntries = new List<MetaField>();
            var callLogs = new List<MetaField>();
            var sms = new List<MetaField>();

            for (int i = 0; i < viterbiResult.Fields.Count; i++)
            {
                switch (viterbiResult.Fields[i].MachineName)
                {
                    case MachineList.Meta_AddressBookNokia:
                    case MachineList.Meta_AddressBook:
                        var results = GetMetaAddressBookEntry(viterbiResult.Fields[i], metaResults);
                        addressBookEntries.AddRange(results);
                        break;

                    case MachineList.Meta_CallLogNokiaMulti_v2:
                    case MachineList.Meta_CallLogNokiaMulti:
                        var results2 = GetMetaCallLogNokia(viterbiResult.Fields[i], metaResults);
                        callLogs.AddRange(results2);
                        break;

                    case MachineList.Meta_CallLogAll:
                    case MachineList.Meta_CallLogGeneric:
                    case MachineList.Meta_CallLogNokiaSingle:
                    case MachineList.Meta_CallLogMoto:
                    case MachineList.Meta_CallLogSamsung:
                        var results1 = GetMetaCallLog(viterbiResult.Fields[i], metaResults);
                        callLogs.AddRange(results1);
                        break;
                    case MachineList.Meta_Sms:
                        var result = GetMetaSms(viterbiResult.Fields[i], metaResults);
                        sms.Add(result);
                        break;
                    default:
                        throw new ArgumentOutOfRangeException();
                        break;
                }
            }

            ///TODO: UNCOMMent these lines of code to insert records into the database
            #if _INSERT_
            MetaField.Insert(parseId, addressBookEntries, true, "Dec0de");
            MetaField.Insert(parseId, callLogs, true, "Dec0de");
            MetaField.Insert(parseId, sms, true, "Dec0de");
            #endif
        }