source: rubysleuth/sleuth.rb @ 367

require 'fileutils'

# TODO when working with an image created with ntfs-3g one can not count
#      on the file or directory names being present.

deps = {
        'ils' => false,
        'fsstat' => false,
        'ifind' => false,
        'icat' => false,
        'istat' => false
}

deps.each_key do |dep|
        ENV['PATH'].split( ':' ).each do |path|
                begin
                        if File.stat( "#{path}/#{dep}" )
                                deps[dep] = true
                                break
                        end
                rescue
                end
        end
end

deps.each_value do |value|
        raise Exception if not value
end

module Sleuth
        $haystack = String.new

        class Image
                def initialize( image )
                        begin
                                raise Exception if not File.stat( image ).readable?
                        rescue
                                raise Exception
                        end

                        $haystack = image
                        @type = ""
                end

                # TODO search is crappy
                # Inode has to be expanded and Directory should inherit from it
                def searchDir( needle )
                        matches = []

                        `ils -Am #{$haystack} | grep '#{needle}'`.split( "\n" ).each do |match|
                                matches.push( Directory.new( match ) )
                                matches.delete_if do |i| i.type != 100 end
                        end

                        matches
                end

                def type
                        if @type.empty?
                                @type = `fsstat #{$haystack} | grep Type`.split( ' ' )[3].downcase
                        end

                        @type
                end
        end

        class Directory
                attr_reader :name, :inode, :mode, :type, :atime

                def initialize( line )
                        tmp = line.split('|')

                        @name = tmp[1]
                        @inode = Inode.new( tmp[2].to_i )
                        @mode = tmp[3]
                        @type = @mode[2]
                        @atime = Time.at( tmp[7].to_i )

                        basename = $haystack.gsub( /^\/.+\//, "" )
                        @name.gsub!( "<#{basename}-", "" )
                        @name.gsub!( "-dead-#{@inode}>", "" )

                        @path = ""
                end

                def to_s
                        "#{name} (#{atime.asctime}) #{inode}"
                end

                def path
                        @path = inode.path if @path.empty?
                        @path
                end

                def recover( *args )
                        if args.empty?
                                inode = Inode.new( self.inode )
                        else
                                inode = Inode.new( args[0] )
                        end

                        FileUtils.mkdir_p( self.path )
                        `ifind -l -p #{inode} #{$haystack}`.each do |item|
                                inode = Inode.new( item.split( " " )[2].to_i )
                                if item[2] == 100
                                        FileUtils.mkdir_p( inode.path )
                                        recover( inode )
                                else
                                        # TODO would be cool to have sth like this:
                                        # d.recover do |item| puts item.path end
#                                       print( "#{inode.path}\n" )
                                        yield
                                        begin
                                                File.stat( inode.path )
                                        rescue
                                                `icat #{$haystack} #{inode} > '#{inode.path}'`
                                        end
                                end
                                # TODO dir mtime is not written
                                # (although it works in tests with irb)
                                FileUtils.touch( inode.path, :mtime => inode.mtime )
                        end
                end
        end

        class Inode
                attr_reader :inode
                
                def initialize( inode )
                        @inode = inode
                        @path = ""
                        @mtime = 0
                end

                def to_s
                        @inode.to_s
                end

                # TODO do not recover whole path for every file
                def path
                        if @path.empty?
                                name = String.new
                                parent = inode
                                tmp = Array.new

                                while name != "."
                                        tmp.push( name ) if not name.empty?
                                        out = `istat #{$haystack} #{parent} | egrep "^Parent|^Name"`.split( "\n" )
                                        name = out[0][6..-1]
                                        parent = out[1].gsub( /^Par.*ry:\ /, "" ).to_i
                                end

                                @path = tmp.reverse.join( "/" )
                        end

                        @path
                end

                def mtime
                        if @mtime == 0
                                out = `istat #{$haystack} #{@inode} | grep 'File Modified'`
                                out = out.split( "\t" ).last.chomp
                                @mtime = Time.mktime(
                                        out[20..23].to_i, # year
                                        out[4..6], # month
                                        out[8..9].to_i, # day
                                        out[11..12].to_i, # hour
                                        out[14..15].to_i, # min
                                        out[17..18].to_i #sec
                                )
                        end

                        @mtime
                end
        end
end