| 17 | namespace Orc { |
| 18 | |
| 19 | HRESULT HiveQuery::BuildStreamList() |
| 20 | { |
| 21 | HRESULT hr = m_HivesFind.Find( |
| 22 | m_HivesLocation, |
| 23 | [this](const std::shared_ptr<FileFind::Match>& match, bool& bStop) { |
| 24 | if (match == nullptr) |
| 25 | { |
| 26 | assert(match); |
| 27 | return; |
| 28 | } |
| 29 | |
| 30 | for (const auto& matchingAttribute : match->MatchingAttributes) |
| 31 | { |
| 32 | Hive hive; |
| 33 | |
| 34 | std::wstringstream tmpStream; |
| 35 | tmpStream << std::hex << match->VolumeReader->VolumeSerialNumber(); |
| 36 | hive.FileName = tmpStream.str() + match->MatchingNames.front().FullPathName; |
| 37 | |
| 38 | hive.Match = match; |
| 39 | hive.Stream = matchingAttribute.DataStream; |
| 40 | |
| 41 | auto it = m_FileFindMap.find(match->Term); |
| 42 | if (it != m_FileFindMap.end()) |
| 43 | { |
| 44 | std::shared_ptr<SearchQuery> query(it->second); |
| 45 | query->StreamList.push_back(std::move(hive)); |
| 46 | } |
| 47 | } |
| 48 | }, |
| 49 | false, |
| 50 | ResurrectRecordsMode::kNo); |
| 51 | |
| 52 | if (FAILED(hr)) |
| 53 | { |
| 54 | Log::Error("Failed to parse locations for hives [{}]", SystemError(hr)); |
| 55 | return hr; |
| 56 | } |
| 57 | |
| 58 | for (const auto& fileName : m_HivesFileList) |
| 59 | { |
| 60 | auto fileStream = std::make_shared<FileStream>(); |
| 61 | hr = fileStream->ReadFrom(fileName.c_str()); |
| 62 | if (FAILED(hr)) |
| 63 | { |
| 64 | Log::Error(L"Failed to open stream for hive: {} [{}]", fileName, SystemError(hr)); |
| 65 | continue; |
| 66 | } |
| 67 | |
| 68 | Hive hive; |
| 69 | hive.Stream = fileStream; |
| 70 | hive.FileName = fileName; |
| 71 | |
| 72 | auto it = m_FileNameMap.find(fileName); |
| 73 | if (it != m_FileNameMap.end()) |
| 74 | { |
| 75 | std::shared_ptr<SearchQuery> query(it->second); |
| 76 | query->StreamList.push_back(std::move(hive)); |
no test coverage detected