reader

Documentation

Index

• type ChecksumPolicy
• type FileHeaderInfo
• type ImageReader
  • func Open(source io.ReaderAt) (*ImageReader, error)
  • func OpenSegments(sources []io.ReaderAt) (*ImageReader, error)
  • func OpenSegmentsWithOptions(sources []io.ReaderAt, opts Options) (*ImageReader, error)
  • func OpenWithOptions(source io.ReaderAt, opts Options) (*ImageReader, error)
  • func (r *ImageReader) Close() error
  • func (r *ImageReader) Header() FileHeaderInfo
  • func (r *ImageReader) MD5() ([]byte, bool)
  • func (r *ImageReader) Metadata() metadata.Info
  • func (r *ImageReader) ReadAt(p []byte, off int64) (int, error)
  • func (r *ImageReader) SHA1() ([]byte, bool)
  • func (r *ImageReader) Sections() []SectionInfo
  • func (r *ImageReader) SectorSize() int
  • func (r *ImageReader) SegmentFileType() SegmentFileType
  • func (r *ImageReader) Size() int64
• type Options
• type SectionInfo
• type SegmentFileType

Types

type ChecksumPolicy

type ChecksumPolicy int

ChecksumPolicy selects what happens when stored checksum validation fails.

const (
	// ChecksumWarn decodes the image anyway and records the failure in
	// Metadata().ChunkTablesInvalid. This is the default: damaged evidence
	// should still yield whatever is readable, with the caller told that it
	// is unverified.
	ChecksumWarn ChecksumPolicy = iota

	// ChecksumIgnore suppresses the accounting entirely.
	ChecksumIgnore

	// ChecksumStrict refuses to open an image in which any chunk table failed
	// validation and could not be recovered from its backup copy. Use it when
	// unverified offsets are worse than no image at all.
	ChecksumStrict
)

type FileHeaderInfo

type FileHeaderInfo struct {
	Signature         [8]uint8
	MajorVersion      uint8
	MinorVersion      uint8
	CompressionMethod uint16
	SegmentNumber     uint32
}

FileHeaderInfo contains parsed file-header fields needed for subsequent parsing.

type ImageReader

type ImageReader struct {
	// contains filtered or unexported fields
}

ImageReader presents a segment set as one contiguous decoded device.

ImageReader is safe for concurrent use provided the underlying io.ReaderAt sources are, as os.File and io.SectionReader are.

func Open

func Open(source io.ReaderAt) (*ImageReader, error)

Open inspects the segment file signature and returns a reader instance.

func OpenSegments

func OpenSegments(sources []io.ReaderAt) (*ImageReader, error)

OpenSegments prepares a single logical reader from one or more EWF segments.

func OpenSegmentsWithOptions

func OpenSegmentsWithOptions(sources []io.ReaderAt, opts Options) (*ImageReader, error)

OpenSegmentsWithOptions prepares a reader from a segment set with explicit options. Segments may be supplied in any order; they are ordered by segment number before decoding.

func OpenWithOptions

func OpenWithOptions(source io.ReaderAt, opts Options) (*ImageReader, error)

OpenWithOptions opens a single segment with explicit options.

func (*ImageReader) Close

func (r *ImageReader) Close() error

Close releases resources held by the reader. The caller retains ownership of the io.ReaderAt sources and is responsible for closing them.

func (*ImageReader) Header

func (r *ImageReader) Header() FileHeaderInfo

Header returns parsed file-header information.

func (*ImageReader) MD5

func (r *ImageReader) MD5() ([]byte, bool)

MD5 returns the stored acquisition MD5 digest, if the image records one.

func (*ImageReader) Metadata

func (r *ImageReader) Metadata() metadata.Info

Metadata returns the parsed descriptor-level metadata summary.

func (*ImageReader) ReadAt

func (r *ImageReader) ReadAt(p []byte, off int64) (int, error)

ReadAt reads decoded device bytes at the given offset, spanning chunk boundaries as needed and transparently decompressing stored chunks.

It satisfies io.ReaderAt: it returns a non-nil error whenever n < len(p), and never returns data at or beyond Size.

func (*ImageReader) SHA1

func (r *ImageReader) SHA1() ([]byte, bool)

SHA1 returns the stored acquisition SHA-1 digest, if the image records one.

func (*ImageReader) Sections

func (r *ImageReader) Sections() []SectionInfo

Sections returns parsed section descriptors in logical order.

func (*ImageReader) SectorSize

func (r *ImageReader) SectorSize() int

SectorSize returns the logical sector size in bytes, or 0 when unknown.

func (*ImageReader) SegmentFileType

func (r *ImageReader) SegmentFileType() SegmentFileType

SegmentFileType returns the detected segment file type.

func (*ImageReader) Size

func (r *ImageReader) Size() int64

Size returns the logical size of the decoded device in bytes, which is NumberOfSectors * BytesPerSector. It returns 0 when the segment set carries no volume geometry.

type Options

type Options struct {
	// AllowIncompleteSegmentSet permits opening a segment set that does not
	// begin at segment 1 or whose final segment carries no "done" section.
	// Such a set decodes only a prefix of the device, so reads past the
	// supplied data return io.EOF even though Size reports the full device.
	// Use it for metadata inspection and for triage of damaged evidence;
	// never for content that will be hashed or carved.
	AllowIncompleteSegmentSet bool

	// ChecksumPolicy selects the response to a chunk table that fails its
	// stored Adler-32 checksum. It currently governs chunk tables only, which
	// are the checksums this reader validates.
	ChecksumPolicy ChecksumPolicy

	// ChunkCacheChunks sets how many decoded chunks to keep cached.
	//
	// Zero selects a default of 16; a negative value disables caching. Memory
	// use is the depth multiplied by the image's chunk size, capped internally
	// so that an unusual chunk size cannot turn a small depth into a large
	// allocation.
	//
	// Caching matters because a chunk is the smallest decodable unit: without
	// it, a caller reading 512 bytes at a time re-decompresses the whole
	// enclosing chunk on every call.
	ChunkCacheChunks int
}

Options controls how a segment set is opened. The zero value is the default, strict-but-forgiving behaviour: structural problems are errors, checksum failures are recorded and reported.

type SectionInfo

type SectionInfo struct {
	Offset         int64
	DescriptorSize uint32
	Type           uint32
	TypeString     string
	DataFlags      uint32
	Size           uint64
	DataOffset     int64
	DataSize       uint64
	PaddingSize    uint32
}

SectionInfo represents a parsed on-disk section descriptor.

type SegmentFileType

type SegmentFileType uint8

SegmentFileType identifies the segment file family.

const (
	SegmentFileTypeUnknown SegmentFileType = iota
	SegmentFileTypeEWF1
	SegmentFileTypeEWF1Logical
	SegmentFileTypeEWF2
	SegmentFileTypeEWF2Logical
)