/// <summary>
/// Initializes sleuthkit with the specified image files (calls tsk_img_open_* methods)
/// </summary>
/// <param name="_files"></param>
private void Init(IEnumerable <FileInfo> _files)
{
if (_files == null)
{
throw new ArgumentException("file must not be null.");
}
if (_files.Any(_ => !_.Exists))
{
throw new ArgumentException("file must exist, cant just be a bogus path.");
}
this.files = _files.ToArray();
var count = files.Length;
if (count == 1)
{
this._handle = NativeMethods.tsk_img_open_sing(this.files[0].FullName, 0, 0);
}
else
{
var image_files_array = new IntPtr[this.files.Count()];
// Each IntPtr array element will point to a copy of a
// string element in the openFileDialog.FileNames array.
// based on answered provided in this link - http://stackoverflow.com/questions/8838455/how-to-convert-c-sharp-string-to-system-intptr
for (int i = 0; i < this.files.Count(); i++)
{
image_files_array[i] = Marshal.StringToCoTaskMemUni(this.files[i].FullName);
}
this._handle = NativeMethods.tsk_img_open(this.files.Count(), image_files_array, 0, 0);
}
if (!this._handle.IsInvalid)
{
this._struct = this._handle.GetStruct();
}
else
{
throw new InvalidOperationException("tsk_img_open didnt work right.");
}
}
internal static extern FileSystemHandle tsk_fs_open_img(DiskImageHandle image, long offset, FileSystemType fstype);
internal static extern VolumeSystemHandle tsk_vs_open(DiskImageHandle image, long offset, VolumeSystemType type);
internal static extern int tsk_img_read(DiskImageHandle img, long a_off, byte[] buf, int len);
