func (table_header *EWF_Table_Section_Header) Parse(buf *bytes.Reader) {
//parse struct attributes
parseutil.Parse(buf, &table_header.nofEntries)
parseutil.Parse(buf, &table_header.Padding)
parseutil.Parse(buf, &table_header.Checksum)
}
func (table_footer *EWF_Table_Section_Footer) Parse(buf *bytes.Reader) {
//parse struct attributes
parseutil.Parse(buf, &table_footer.Checksum)
}
func (ewf_header *EWF_Header) Parse(buf *bytes.Reader) {
//parse struct attributes
//iterate through the fields of the struct
defer parseutil.TimeTrack(time.Now(), "Parsing")
s := reflect.ValueOf(ewf_header).Elem()
for i := 0; i < s.NumField(); i++ {
parseutil.Parse(buf, s.Field(i).Addr().Interface())
}
}
func (digest_section *EWF_Digest_Section) Parse(r *bytes.Reader) {
defer parseutil.TimeTrack(time.Now(), "Parsing")
s := reflect.ValueOf(digest_section).Elem()
for i := 0; i < s.NumField(); i++ {
//parse struct attributes
parseutil.Parse(r, s.Field(i).Addr().Interface())
}
}
func (section_header *Section_Header) Parse(buf *bytes.Reader) {
defer parseutil.TimeTrack(time.Now(), "Parsing") //header of each section
s := reflect.ValueOf(section_header).Elem()
for i := 0; i < s.NumField(); i++ {
//parse struct attributes
parseutil.Parse(buf, s.Field(i).Addr().Interface())
}
}
func (table_entry *EWF_Table_Section_Entry) Parse(buf *bytes.Reader) {
var b *bytes.Reader
val := make([]byte, int64(buf.Len()))
buf.Read(val)
//parse struct attributes
table_entry.IsCompressed = val[3] << 1 & 1
val[3] &= 0x7F //exlude MSB
b = bytes.NewReader(val)
parseutil.Parse(b, &table_entry.ChunkDataOffset)
}
func (ewf_h2_section *EWF_Header2_Section) Parse(buf *bytes.Reader) {
//0x09 tab 0x0a new line delimiter
//function to parse header2 section attributes
//to do take into account endianess
val := make([]byte, buf.Len())
buf.Read(val)
val = parseutil.Decompress(val)
defer parseutil.TimeTrack(time.Now(), "Parsing")
line_del, _ := hex.DecodeString("0a")
tab_del, err := hex.DecodeString("09")
if err != nil {
log.Fatal(err)
}
var b *bytes.Reader
for line_number, line := range bytes.Split(val, line_del) {
for id_num, attr := range bytes.Split(line, tab_del) {
b = bytes.NewReader(attr)
if line_number == 0 {
parseutil.Parse(b, &ewf_h2_section.BOM)
parseutil.Parse(b, &ewf_h2_section.NofCategories)
} else if line_number == 1 {
parseutil.Parse(b, &ewf_h2_section.CategoryName)
} else if line_number == 2 {
} else if line_number == 3 {
if id_num == EWF_HEADER_VALUES_INDEX_DESCRIPTION {
ewf_h2_section.a = string(attr)
fmt.Println("TIME", ewf_h2_section.a)
} else if id_num == EWF_HEADER_VALUES_INDEX_CASE_NUMBER {
ewf_h2_section.c = string(attr)
} else if id_num == EWF_HEADER_VALUES_INDEX_EXAMINER_NAME {
ewf_h2_section.n = string(attr)
} else if id_num == EWF_HEADER_VALUES_INDEX_EVIDENCE_NUMBER {
ewf_h2_section.e = string(attr)
} else if id_num == EWF_HEADER_VALUES_INDEX_NOTES {
ewf_h2_section.t = string(attr)
} else if id_num == EWF_HEADER_VALUES_INDEX_ACQUIRY_SOFTWARE_VERSION {
ewf_h2_section.av = string(attr)
} else if id_num == EWF_HEADER_VALUES_INDEX_ACQUIRY_OPERATING_SYSTEM {
ewf_h2_section.ov = string(attr)
} else if id_num == EWF_HEADER_VALUES_INDEX_ACQUIRY_DATE {
ewf_h2_section.m = parseutil.SetTime(attr)
} else if id_num == EWF_HEADER_VALUES_INDEX_SYSTEM_DATE {
ewf_h2_section.u = parseutil.SetTime(attr)
} else if id_num == EWF_HEADER_VALUES_INDEX_PASSWORD {
ewf_h2_section.p = string(attr)
} else if id_num == EWF_HEADER_VALUES_INDEX_PROCESS_IDENTIFIER {
ewf_h2_section.pid = string(attr)
}
}
}
}
}