/// <summary>
/// Get the bytes of the chunk that contains a specified offset.
/// </summary>
/// <param name="start">The position in the stream for which bytes are wanted.</param>
/// <param name="currentChunkIndex">Stores the index of the chunk.</param>
/// <returns>byte array containing the bytes of the chunk.</returns>
private byte[] getChunk(long start, out int currentChunkIndex)
{
currentChunkIndex = mapRequestToChunkInfo(start, out _currentChunkPointer);
byte[] buff = new byte[_chunkInfos[currentChunkIndex].BytesInChunk];
byte[] emulatedBytes = new byte[_bytesPerChunk];
using (FileStream fs = File.OpenRead(Files[_chunkInfos[currentChunkIndex].FileIndex]))
{
fs.Seek(_chunkInfos[currentChunkIndex].FileOffset, SeekOrigin.Begin);
fs.Read(buff, 0, _chunkInfos[currentChunkIndex].BytesInChunk);
if (_chunkInfos[_currentChunkIndex].IsCompressed) // If compressed...
{
using (MemoryStream ms = new MemoryStream(buff, false)) // ...decompress...
{
DiscUtils.Compression.ZlibStream zlib = new Compression.ZlibStream(ms, System.IO.Compression.CompressionMode.Decompress, true);
zlib.Read(emulatedBytes, 0, _bytesPerChunk);
}
}
else // ...no need.
{
emulatedBytes = buff;
}
}
return(emulatedBytes); // decompressed (or not) bytes
}
/// <summary>
/// <para>Represents the Header2 section of the EWF file.</para>
/// <para>Holds various meta-data about the acquisition.</para>
/// </summary>
/// <param name="bytes">The bytes that make up the Header2 section.</param>
public Header2(byte[] bytes)
{
string header = null; // Will eventually hold the decompressed Header2 info
#region Decompress zlib'd data
{
byte[] buff = new byte[1024];
using (System.IO.MemoryStream ms = new System.IO.MemoryStream(bytes))
{
using (Compression.ZlibStream zs = new Compression.ZlibStream(ms, System.IO.Compression.CompressionMode.Decompress, false))
{
using (System.IO.MemoryStream decomp = new System.IO.MemoryStream())
{
int n;
while ((n = zs.Read(buff, 0, buff.Length)) != 0)
{
decomp.Write(buff, 0, n);
}
decomp.Seek(0, System.IO.SeekOrigin.Begin);
System.IO.StreamReader sr = new System.IO.StreamReader(decomp, System.Text.Encoding.UTF8);
header = sr.ReadToEnd();
}
}
}
}
#endregion
string[] parts = header.Split(new char[] { (char)0x0A });
int catsCount = int.Parse(parts[0]);
Categories = new List<Header2Category>(catsCount);
if (catsCount == 1) // EnCase 4
{
for (int i = 0; i < parts.Length; i++) // Header seems to have 0x0A on the end
parts[i] = parts[i].TrimEnd('\r');
if (parts[1] != "main")
throw new ArgumentException(string.Format("unexpected category: {0}", parts[1]));
Categories.Add(new Header2Category("main", parts[2], parts[3]));
}
else if (catsCount == 3) // EnCase 5-7
{
if (parts[1] != "main")
throw new ArgumentException(string.Format("unexpected category: {0}", parts[1]));
Categories.Add(new Header2Category("main", parts[2], parts[3]));
if (parts[5] != "srce")
throw new ArgumentException(string.Format("unexpected category: {0}", parts[5]));
Categories.Add(new Header2Category("srce", parts[7], parts[9]));
if (parts[11] != "sub")
throw new ArgumentException(string.Format("unexpected category: {0}", parts[13]));
Categories.Add(new Header2Category("sub", parts[13], parts[15]));
}
else
{
throw new ArgumentException(string.Format("unknown category layout ({0} categories)", catsCount));
}
}
/// <summary>
/// <para>Represents the Header2 section of the EWF file.</para>
/// <para>Holds various meta-data about the acquisition.</para>
/// </summary>
/// <param name="bytes">The bytes that make up the Header2 section.</param>
public Header2(byte[] bytes)
{
string header = null; // Will eventually hold the decompressed Header2 info
#region Decompress zlib'd data
{
byte[] buff = new byte[1024];
using (System.IO.MemoryStream ms = new System.IO.MemoryStream(bytes))
{
using (Compression.ZlibStream zs = new Compression.ZlibStream(ms, System.IO.Compression.CompressionMode.Decompress, false))
{
using (System.IO.MemoryStream decomp = new System.IO.MemoryStream())
{
int n;
while ((n = zs.Read(buff, 0, buff.Length)) != 0)
{
decomp.Write(buff, 0, n);
}
decomp.Seek(0, System.IO.SeekOrigin.Begin);
System.IO.StreamReader sr = new System.IO.StreamReader(decomp, System.Text.Encoding.UTF8);
header = sr.ReadToEnd();
}
}
}
}
#endregion
string[] parts = header.Split(new char[] { (char)0x0A });
int catsCount = int.Parse(parts[0]);
Categories = new List <Header2Category>(catsCount);
if (catsCount == 1) // EnCase 4
{
for (int i = 0; i < parts.Length; i++) // Header seems to have 0x0A on the end
{
parts[i] = parts[i].TrimEnd('\r');
}
if (parts[1] != "main")
{
throw new ArgumentException(string.Format("unexpected category: {0}", parts[1]));
}
Categories.Add(new Header2Category("main", parts[2], parts[3]));
}
else if (catsCount == 3) // EnCase 5-7
{
if (parts[1] != "main")
{
throw new ArgumentException(string.Format("unexpected category: {0}", parts[1]));
}
Categories.Add(new Header2Category("main", parts[2], parts[3]));
if (parts[5] != "srce")
{
throw new ArgumentException(string.Format("unexpected category: {0}", parts[5]));
}
Categories.Add(new Header2Category("srce", parts[7], parts[9]));
if (parts[11] != "sub")
{
throw new ArgumentException(string.Format("unexpected category: {0}", parts[13]));
}
Categories.Add(new Header2Category("sub", parts[13], parts[15]));
}
else
{
throw new ArgumentException(string.Format("unknown category layout ({0} categories)", catsCount));
}
}