예제 #1
0
        public CarverResults(FileCarver analyzer, TaskRunner taskRunner)
        {
            InitializeComponent();

            this._analyzer  = analyzer;
            this._volume    = analyzer.GetVolume();
            this.taskRunner = taskRunner;
            PopulateResultsList(analyzer.GetCarvedFiles());
        }
        private void SaveFileCarver(List <Dictionary <string, object> > fileCarverList)
        {
            foreach (var file in fileCarver.GetCarvedFiles())
            {
                var fileCarverObject = new Dictionary <string, object>();

                fileCarverObject["Offset"] = file.Offset;
                fileCarverObject["Name"]   = file.FileName;
                fileCarverObject["Size"]   = file.FileSize;

                fileCarverList.Add(fileCarverObject);
            }
        }
        public void LoadFromJson(JsonElement partitionElement)
        {
            // We are loading a new database so clear previous results
            fileDatabase.Reset();

            // Find the Analysis element, which contains analysis results
            JsonElement analysisElement;

            if (!partitionElement.TryGetProperty("Analysis", out analysisElement))
            {
                var name = partitionElement.GetProperty("Name").GetString();
                throw new FileLoadException($"Database: Partition ${name} is missing Analysis object!");
            }

            if (analysisElement.TryGetProperty("MetadataAnalyzer", out var metadataAnalysisList))
            {
                // Loads the files from the json into the FileDatabase
                // Only post the results if there actually was any
                if (LoadFromDatabase(metadataAnalysisList))
                {
                    OnLoadRecoveryFromDatabase?.Invoke(null, null);

                    // Mark that analysis was done
                    this.metadataAnalyzer = true;
                }
                else
                {
                    // Element was there but no analysis results were loaded
                    this.metadataAnalyzer = false;
                }
            }

            if (analysisElement.TryGetProperty("FileCarver", out var fileCarverList))
            {
                // TODO: We will begin replacing this when we start work on customizable "CarvedFiles"
                var analyzer = new FileCarver(this.volume, FileCarverInterval.Cluster, this.volume.Length);

                analyzer.LoadFromDatabase(fileCarverList);

                if (analyzer.GetCarvedFiles().Count > 0)
                {
                    view.CreateCarverView(analyzer);
                    this.fileCarver = analyzer;
                }
            }
        }