srch_strings_wrap

#!/usr/bin/perl

# Written by: Dave Lassalle, @superponible
# Additional code and ideas by: Hal Pomeranz
# 
# A wrapper around srch_strings.  This can be used in place of srch_strings,
#   and will forward all command line options to srch_strings.  If -b
#   or -d is specified along with "-t d", the additional functionality of
#   this script is available.

#TODO
# handle swap partition but print differently
# use fib to recover file based on block found
# add capability to only search unallocated - blkls, blkcalc
# option to indicate image is unalloc image and also specify orig image
# precomputer file to inode mapping using fls to save exec time

use strict;
use Getopt::Std;
use File::Path;
use File::Basename;

my $scriptname = "srch_strings_wrap";

# filesystem commands used in script
my $srch_strings_cmd = "/usr/local/bin/srch_strings";
my $srch_strings_cmd_alt1 = "/usr/local/bin/srch_strings_orig";
my $srch_strings_cmd_alt2 = "/usr/local/bin/srch_strings.orig";
if (-f $srch_strings_cmd_alt1) {
	$srch_strings_cmd = $srch_strings_cmd_alt1;
}
if (-f $srch_strings_cmd_alt2) {
	$srch_strings_cmd = $srch_strings_cmd_alt2;
}
my $blkstat_cmd = "/usr/local/bin/blkstat";
my $fsstat_cmd = "/usr/local/bin/fsstat";
my $ifind_cmd = "/usr/local/bin/ifind";
my $istat_cmd = "/usr/local/bin/istat";
my $ffind_cmd = "/usr/local/bin/ffind";
my $icat_cmd = "/usr/local/bin/icat";
my $blkcat_cmd = "/usr/local/bin/blkcat";
my $mmls_cmd = "/usr/local/bin/mmls";
my $dd_cmd = "/bin/dd";
my $grep_cmd = "/bin/egrep";

# replace -# with -n # and - with -a
@ARGV = fix_args(@ARGV);

my @original_args = @ARGV;
my %opts = ();
getopts('hb:dw:HF:CONg:G:il:APD:I:afn:t:oe:v', \%opts) || die usage();
my @files = @ARGV;				# should be the file arguments

# set up some default values
my $blksize = 0;
my $base = "";
my $delim = "\t";
my $level = 3;
my $dd_skip = "";
my $dd_count = "";
my $img_type = "F";
my $grep_case = "";
my $grep_srch_cmd = "";
my $csv = "";
my $output_dir = "ssw_output";
my $logfile = "$scriptname.log";
my $log = 0;
my $pre_image = "";

parse_opts(\%opts,\$blksize,\$base,\$delim,\$level,\$grep_case,\$grep_srch_cmd,\$csv,\$output_dir,\$log,\$logfile,\$pre_image);
if ($opts{'P'} && @files > 0) {
	usage();
	exit(1);
}

mkpath($output_dir) if ($opts{'A'});
mkpath(dirname($logfile)) if ($opts{'w'});

if (!$opts{'d'} && !$opts{'b'} && !$opts{'P'} || !$opts{'d'} && $blksize == 1) {
	# no -d or -b, or no -d and -b invalid, so run regular srch_strings 
	#    with other arguments
	my $srch_strings_args = strip_custom_args($files[0], @original_args);
	my $ss_cmd = "$srch_strings_cmd $srch_strings_args @files";
	open (SS, "$ss_cmd |") or die "$ss_cmd: $!\n";
	print while (<SS>);
	close SS;
} elsif ($opts{'P'}) {
	$opts{'t'} = "d";
	my $srch_strings_args = strip_custom_args($files[0],@original_args);
	my $first_line = 1;
	my $file = $pre_image;
	my %status = ();		# tracks allocated/not allocated block status
	my %inode = ();			# tracks inodes of blocks
	my %istatus = ();		# tracks allocated/not allocated inode status
	my %filename = ();		# tracks filenames
	my $sector = 512;
	my %part_skip = ("N/A",0);
	my %part_count = ("N/A","9999999999999999999");
	
	get_partition_info($file,\$sector,\$img_type,\%part_skip,\%part_count);

	print_header($log,$logfile,\%opts,\$img_type,\$csv,\$delim) if ($opts{'H'} && !$opts{'N'} && $first_line);
	
	$first_line = 0;
	my $key = "N/A";
	my $val = 0;
	
	$blksize = get_block_size($fsstat_cmd, $val, $file) if ($opts{'I'});

	my $fgrep = "";
	my $firstgrep = 1;
	if ($opts{'G'}) {
		open (GREPFILE, "$opts{'G'}") or die "couldn't open $opts{'G'}: $!\n";
		while (<GREPFILE>) {
			if (!$firstgrep) {
				$fgrep = $fgrep . "|";
			} 
			chomp;
			$fgrep = $fgrep . $_;
			$firstgrep = 0;
		}
		close GREPFILE;
	}

	my $last_inode = "";
	my $last_block = "";
	while (<STDIN>) {
		# parse srch_strings output, if -f specified, handle additional column
		my ($filename, $bytes, $string) = parse_strings($opts{'f'},$_);

        	if ($opts{'g'}) {
                	next if ($string !~ m/$opts{'g'}/gi);
        	} elsif ($opts{'G'}) {
                	next if ($string !~ m/$fgrep/gi);
        	}

		# CSV output so replace single quote with double in string column
		$string =~ s/\"/\"\"/g if ($opts{'C'});

		my $blk = int($bytes/$blksize);
		my $blk_offset = $bytes%$blksize;

		$status{$blk} = get_block_allocation_status($level,$blkstat_cmd,$part_skip{$key},$file,$blk) unless (length($status{$blk}));	

		# get inode number for block
		if ($level > 1) {
			$inode{$blk} = get_inode($ifind_cmd,$part_skip{$key},$file,$blk) unless (length($inode{$blk}));
			$istatus{$inode{$blk}} = get_inode_allocation_status($istat_cmd,$part_skip{$key},$file,$inode{$blk}) unless (length($istatus{$inode{$blk}}));
		}

		# get filename
		if ($level > 2) {
			$filename{$inode{$blk}} = get_filename($ffind_cmd,$part_skip{$key},$file,$inode{$blk}) unless (length($filename{$inode{$blk}}));
		}
		
		if ($opts{'O'} || $opts{'A'}) {
			# no inode, so just print a header for each block, then print blocks, offsets, and string
			if ($inode{$blk} eq "NF" || $inode{$blk} eq "Metadata" || $inode{$blk} eq "") {
				if ($last_block ne $blk) {
					print_group_block($log,$logfile,$file,$key,$filename{$inode{$blk}},$istatus{$inode{$blk}},
							  $inode{$blk},$blk,$blkcat_cmd,$part_skip{$key},$srch_strings_cmd,
							  $srch_strings_args,$grep_srch_cmd) if ($opts{'O'});
					carve_block($output_dir,$file,$key,$filename{$inode{$blk}},$inode{$blk},
						    $blk,$blkcat_cmd,$part_skip{$key}) if ($opts{'A'});
				}
			} else {
				if ($last_inode ne $inode{$blk}) {
					print_group_inode($log,$logfile,$file,$key,$filename{$inode{$blk}},$istatus{$inode{$blk}},
							  $inode{$blk},$icat_cmd,$part_skip{$key},$srch_strings_cmd,
							  $srch_strings_args,$grep_srch_cmd) if ($opts{'O'});
					carve_inode($output_dir,$file,$key,$filename{$inode{$blk}},$inode{$blk},
						    $icat_cmd,$istat_cmd,$part_skip{$key}) if ($opts{'A'});
				}
			}
			$last_inode = $inode{$blk};
			$last_block = $blk;
		} 
		if (!$opts{'O'} && !$opts{'N'}) {
			# print srch_strings output with additional fields
			print_output($log,$logfile,\%opts,$img_type,$file,$key,$filename{$inode{$blk}},
				     $istatus{$inode{$blk}},$inode{$blk},$status{$blk},$blk,
				     $blk_offset,$bytes,$string,$delim,$csv,$level);
		}
	}
} else {
	check_base($base);		# check that -t d was specified

	# Get argument list to pass to srch_strings
	my $srch_strings_args = strip_custom_args($files[0], @original_args);
	my $first_line = 1;

	# loop through each of the file arguments at the end of the command line
	foreach (@files) {
		# set up some default values
		my $file = $_;
		my %status = ();		# tracks allocated/not allocated block status
		my %inode = ();			# tracks inodes of blocks
		my %istatus = ();		# tracks allocated/not allocated inode status
		my %filename = ();		# tracks filenames
		my $sector = 512;
		my %part_skip = ("N/A",0);
		my %part_count = ("N/A","9999999999999999999");

		get_partition_info($file,\$sector,\$img_type,\%part_skip,\%part_count);

		print_header($log,$logfile,\%opts,$img_type,\$csv,\$delim) if ($opts{'H'} && !$opts{'N'} && $first_line);
		$first_line = 0;

		# loop through each partition of disk image, or just the one filesystem in a partition image
		while (my ($key,$val) = each(%part_skip)) {
			# if -d specified, use fsstat to get block size
			$blksize = get_block_size($fsstat_cmd, $part_skip{$key}, $file) if ($opts{'d'});

			# run srch_strings with arguments and pipe output
			my $ss_cmd = "$dd_cmd if=$file skip=$part_skip{$key} status=noxfer bs=$sector count=$part_count{$key} 2>/dev/null | $srch_strings_cmd $srch_strings_args $grep_srch_cmd";
			open (SS_OUT, "$ss_cmd |") || die "$ss_cmd: $!\n";
	
			# loop through search strings output
			my $last_inode = "";
			my $last_block = "";
			while (<SS_OUT>) {
				# parse srch_strings output, if -f specified, handle additional column
				my ($filename, $bytes, $string) = parse_strings($opts{'f'},$_);

				# CSV output so replace single quote with double in string column
				$string =~ s/\"/\"\"/g if ($opts{'C'});

				my $blk = int($bytes/$blksize);
				my $blk_offset = $bytes%$blksize;
			
				$status{$blk} = get_block_allocation_status($level,$blkstat_cmd,$part_skip{$key},$file,$blk) unless (length($status{$blk}));	

				# get inode number for block
				if ($level > 1) {
					$inode{$blk} = get_inode($ifind_cmd,$part_skip{$key},$file,$blk) unless (length($inode{$blk}));
					$istatus{$inode{$blk}} = get_inode_allocation_status($istat_cmd,$part_skip{$key},$file,$inode{$blk}) unless (length($istatus{$inode{$blk}}));
				}

				# get filename
				if ($level > 2) {
					$filename{$inode{$blk}} = get_filename($ffind_cmd,$part_skip{$key},$file,$inode{$blk}) unless (length($filename{$inode{$blk}}));
				}


				if ($opts{'O'} || $opts{'A'}) {
					# no inode, so just print a header for each block, then print blocks, offsets, and string
					if ($inode{$blk} eq "NF" || $inode{$blk} eq "Metadata" || $inode{$blk} eq "") {
						if ($last_block ne $blk) {
							print_group_block($log,$logfile,$file,$key,$filename{$inode{$blk}},$istatus{$inode{$blk}},
									  $inode{$blk},$blk,$blkcat_cmd,$part_skip{$key},$srch_strings_cmd,
									  $srch_strings_args,$grep_srch_cmd) if ($opts{'O'});
							carve_block($output_dir,$file,$key,$filename{$inode{$blk}},$inode{$blk},
								    $blk,$blkcat_cmd,$part_skip{$key}) if ($opts{'A'});
						}
					} else {
						if ($last_inode ne $inode{$blk}) {
							print_group_inode($log,$logfile,$file,$key,$filename{$inode{$blk}},$istatus{$inode{$blk}},
									  $inode{$blk},$icat_cmd,$part_skip{$key},$srch_strings_cmd,
									  $srch_strings_args,$grep_srch_cmd) if ($opts{'O'});
							carve_inode($output_dir,$file,$key,$filename{$inode{$blk}},$inode{$blk},
								    $icat_cmd,$istat_cmd,$part_skip{$key}) if ($opts{'A'});
						}
					}
					$last_inode = $inode{$blk};
					$last_block = $blk;
				} 
				if (!$opts{'O'} && !$opts{'N'}) {
					# print srch_strings output with additional fields
					print_output($log,$logfile,\%opts,$img_type,$file,$key,$filename{$inode{$blk}},
						     $istatus{$inode{$blk}},$inode{$blk},$status{$blk},$blk,
						     $blk_offset,$bytes,$string,$delim,$csv,$level);
				}
			}
			close SS_OUT;
		}
	}
}

exit 0;
	
#############################################################
# Subroutines
#############################################################

# print usage statement
sub usage {
	print <<EOF;
usage: $scriptname [OPTION(s)] [FILE(s)]

$scriptname is a wrapper for the srch_strings command and can be used in its 
	place. Must give -b or -d, plus "-t d" options for extra functionality.
Basic example: $scriptname -d -a -t d file.img

OPTIONS (wrapper specific):
   -h      	     Print this help message
   -b blocksize      block size of filesystem in imagefile(s)
   -d		     Determine block size of each file argument using fsstat
   -w file	     Write stdout to file, default is srch_strings_wrap.log
   -H 		     Print a header line
   -F delim  	     Delimiter in output, default is tab 
   -C		     Output in CSV, with quotes to handle spaces
   -O		     Output in format grouped by files/inodes, 
			overrides -H, -F, -C; requires -l 2 or higher
			if with -P, need to give all the original strings opts
   -N 		     Do not print output
   -g string	     string to pass to grep to limit results
   -G file	     file of dirty words to pass to grep to limit results
   -i		     ignore case on grep
   -l level	     level of layers to lookup into
			0 = print just like srch_strings, able to separate 
				partitions in disk image
			1 = print block and block allocation status
			2 = print inode and inode allocation status
			3 = print filename
   -A 		     autocarve, will take a while, best with tight grep cmds
   -D		     autocarve output dir, will default to ./ssw_output 
   -P		     accept precomputed "strings -t d <-e l/b>" from
			the pipeline
   -I image	     the image used in the precomputed strings output

OPTIONS (standard srch_strings options)
   -a                Scan the entire file, not just the data section
   - 		     Same as -a
   -f     	     Print the name of the file before each string
   -n number         Locate & print any NUL-terminated sequence of at
			least [number] characters (default 4).
   -<number>         Same as -n number 
   -t {o,x,d}        Print the location of the string in base 8, 10 or 16
   -o                An alias for --radix=o
   -e {s,S,b,l,B,L}  Select character size and endianness:
                        s = 7-bit, S = 8-bit, {b,l} = 16-bit, {B,L} = 32-bit
   -h                Display this information
   -v                Print the program's version number

EOF
}

# replace -# with -n #, and - with -a
sub fix_args {
	my @tmpARGV = @_;
	my @newARGV = ();
	foreach(@tmpARGV) {
		if (/-(\d+)$/) {
			push(@newARGV,"-n");
			push(@newARGV,"$1");
		} elsif (/^-$/) {
			push(@newARGV,"-a");
		} else {
			push(@newARGV, $_);
		}
	}
	return @newARGV;
}

sub strip_custom_args {
	# return argument list to pass to srch_strings
	my ($first, @args) = @_;
	my $skip = 0;
	my $srch_strings_args = "";
	foreach (@args) {
		if (/-[bFgGlDw]/) {
			# skip -b, -F, -g, -G, -l, -D, -w and next argument
			$skip = 1;
		} elsif ($skip == 1 || /-[dHONCAPIi]/) {
			# skip argument after -b or skip -d, -H, -O, -N, -C, -A, -P, -I, -i
			$skip = 0;
		} elsif ($_ eq $first) {
			# match the first file argument, so stop
			last;
		} else {
			# add current arg to new list
			$srch_strings_args = $srch_strings_args . " $_";
		} 
	}
	return $srch_strings_args;
}

sub parse_opts {
	my ($opts_ref,$blksize,$base,$delim,$level,$grep_case,$grep_srch_cmd,$csv,$output_dir,$log,$logfile,$pre_image) = @_;
	my $opts = %$opts_ref;	

	# help flag given
	if ($opts{'h'} == 1) {
		usage();
		exit(1);
	}
	#blocksize specifed
	if ($opts{'b'}) {
		$$blksize = $opts{'b'};
		# -b given with no argument
		if ($$blksize =~ /^-|[^\d]/) {
			usage();
			exit(1);
		}
	}
	# -t specified, store base in $base
	$$base = $opts{'t'} if ($opts{'t'});
	
	# custom delimiter specified
	$$delim = $opts{'F'} if ($opts{'F'});
	
	# level of lookup to perform
	$$level = $opts{'l'} if defined($opts{'l'});
	if ($$level < 0 || $$level > 3 || ($opts{'O'} && $$level < 2)) {
		usage();
		exit(1);
	}
	
	$$grep_case = " -i " if ($opts{'i'});

	if ($opts{'g'} && $opts{'G'}) {
		usage();
		exit(1);
	} elsif ($opts{'g'}) {
		$$grep_srch_cmd = " | $grep_cmd $$grep_case '$opts{'g'}'"; 
	} elsif ($opts{'G'}) {
		$$grep_srch_cmd = " | $grep_cmd $$grep_case -f '$opts{'G'}'";
	}
	
	if ($opts{'O'} && ($opts{'H'} || $opts{'C'} || $opts{'F'})) {
		usage();
		exit(1);
	}	

	# csv mode, set delimiter to comma
	if ($opts{'C'}) {
		$$delim = ",";
		$$csv = "\"";
	}

	# set output dir for autocarve
	if ($opts{'D'}) {
		$$output_dir = $opts{'D'};
	}

	# output of logfile
	if ($opts{'w'}) {
		$$log = 1;
		$$logfile = $opts{'w'};
		if (-e $$logfile) {
			unlink $$logfile or die "couldn't delete old log file $$logfile: $!\n";
		}
	}
	
	if ($opts{'P'}) {
		if ($opts{'I'}) {
			$$pre_image = $opts{'I'};
		} else {
			usage();
			exit(1);
		}
	}
}

sub check_base {
	my $base = $_[0];
	# either valid -b or -d specified
	if ($base ne "d") {
		# base was not decimal
		print "Must use \"-t d\" with -b or -d option.\n\n";
		usage();
		exit(1);
	}
}

sub print_header {
	my ($log,$logfile,$opts_ref,$img_type,$csv_ref,$delim_ref) = @_;
	my $opts = %$opts_ref;
	my $csv = $$csv_ref;
	my $delim_ref = $$delim_ref;

	my $imagename_print = "";
	$imagename_print = "${csv}IMG FILE${csv}${delim}" if ($opts{'f'});
	
	my $partition_print = "";
	$partition_print = "${csv}PARTITION${csv}${delim}" if ($img_type eq "D");

	my $filename_print = "${csv}FILENAME${csv}${delim}" if ($level > 2);
	my $istatus_print = "${csv}I_STATUS${csv}${delim}" if ($level > 1);
	my $inode_print = "${csv}INODE${csv}${delim}" if ($level > 1);
	my $status_print = "${csv}B_STATUS${csv}${delim}" if ($level > 0); 
	my $blk_print = "${csv}BLOCK${csv}${delim}" if ($level > 0);
	my $blk_offset_print = "${csv}B_OFFSET${csv}${delim}" if ($level > 0);

	print "${imagename_print}${partition_print}${filename_print}${istatus_print}${inode_print}${status_print}${blk_print}${blk_offset_print}${csv}BYTE OFFSET${csv}${delim}${csv}STRING${csv}\n";
	if ($log) {
		open (OUT, ">>$logfile") or die "couldn't open $logfile: $!\n";
		print OUT "${imagename_print}${partition_print}${filename_print}${istatus_print}${inode_print}${status_print}${blk_print}${blk_offset_print}${csv}BYTE OFFSET${csv}${delim}${csv}STRING${csv}\n";
		close OUT;
	}
}

sub parse_strings {
	my ($opt_f,$line) = @_;
	if ($opts{'f'}) {
		my ($filename,$bytes,$string) = /^\s*(.+?):\s+(\d+)\s+(.*)$/;
		return ($filename, $bytes, $string);
	} else {
		my ($bytes,$string) = /^\s*(\d+)\s+(.*)$/;
		return ("", $bytes, $string);
	}
}

sub get_partition_info {
	my ($file,$sector,$img_type,$part_skip_ref,$part_count_ref) = @_;
	my $mm_cmd = "$mmls_cmd $file";
	$$img_type = "F";
		
	open (MM_OUT, "$mm_cmd 2>&1 |") || die "$mm_cmd: $!\n";
	while (<MM_OUT>) {
		next if (/\(0x82\)$/);
		if (m/Cannot determine partition type/) {
			last;
		} elsif (m/^Units are in (\d+)-byte/) {
			$$sector = $1;
		} elsif (m/\s+(\d\d:\d\d)\s+(\d+)\s+\d+\s+(\d+)/) {
			%$part_skip_ref->{$1} = $2;
			%$part_count_ref->{$1} = $3;
			$$img_type = "D";
		}
	}

	if ($$img_type eq "D") {
		delete(%$part_skip_ref->{"N/A"});
		delete(%$part_count_ref->{"N/A"});
	}
	close MM_OUT;
}

sub get_block_size {
	my ($fsstat_cmd, $part_skip, $file) = @_;
	my $fs_cmd = "$fsstat_cmd -o $part_skip $file";
	open (FS, "$fs_cmd |") || die "$fs_cmd: $!\n";
	while (<FS>) {
		next unless (/(Cluster|Block) Size: (\d+)/);
		close FS;
		return($2)
	}
}

sub get_block_allocation_status {
	my ($level,$blkstat_cmd,$part_skip,$file,$blk) = @_;
	my $bs_cmd = "$blkstat_cmd -o $part_skip $file $blk";
	my $status;

	# get block allocation status
	if ($level > 0) {
		open(BS, "$bs_cmd |") || die "$bs_cmd: $!\n";
		while (<BS>) {
			next unless (/Allocated/);
			($status = $_) =~ s/[^NA]//g;
			close BS;
			return $status;
		}
	}
}
	
sub get_inode {
	my ($ifind_cmd,$part_skip,$file,$blk) = @_;
	my $if_cmd = "$ifind_cmd -o $part_skip $file -d $blk";
	my $inode = ""; 
	open(IF, "$if_cmd |") || die "$if_cmd: $!\n";
	while (<IF>) {
		next unless (/\d+|Inode not found|Meta Data/);
		chomp;
		close IF;
		if (/^I/) {
			return "NF";
		} elsif (/^M/) {
			return "Metadata";
		} else {
			return $_;
		}
	}
}
				
sub get_inode_allocation_status {
	my ($istat_cmd,$part_skip,$file,$inode) = @_;
	my $is_cmd = "$istat_cmd -o $part_skip $file $inode";
	my $istatus = "";

	# get inode allocation status
	if ($inode eq "NF" || $inode eq "Metadata") {
		return "NF";
	} else {
		open(IS, "$is_cmd |") || die "$is_cmd: $!\n";
		while (<IS>) {
			next unless (/Allocated/);
			($istatus = $_) =~ s/[^NA]//g;
			close IS;
			return $istatus;
		}
	}
}	
	
sub get_filename {
	my ($ffind_cmd,$part_skip,$file,$inode) = @_;
	my $ff_cmd = "$ffind_cmd -o $part_skip $file $inode";
	if ($inode ne "NF" && $inode ne "Metadata") {
               	open(FF, "$ff_cmd |") || die "$ff_cmd: $!\n";
           	while (<FF>) {
               		chomp;
			s/^\* /DELETED\//;
			close FF;
			if (/^File name not found/) {
				return "FILENAME_NF";
			} else {
				return $_;
			}
               	}
	} else {
		return "FILENAME_NF";
	}
}
	
sub print_output {
	my ($log,$logfile,$opts_ref,$img_type,$file,$key,$filename,$istatus,$inode,$status,$blk,$blk_offset,$bytes,$string,$delim,$csv,$level) = @_;
	my $opts = %$opts_ref;

	my $imagename_print = "";
	$imagename_print = "${csv}${file}${csv}${delim}" if ($opts{'f'});

	my $partition_print = "";
	$partition_print = "${csv}${key}${csv}${delim}" if ($img_type eq "D");
	
	my $filename_print = "${csv}${filename}${csv}${delim}" if ($level > 2);
	my $istatus_print = "${csv}${istatus}${csv}${delim}" if ($level > 1);
	my $inode_print = "${csv}${inode}${csv}${delim}" if ($level > 1);
	my $status_print = "${csv}${status}${csv}${delim}" if ($level > 0); 
	my $blk_print = "${csv}${blk}${csv}${delim}" if ($level > 0);
	my $blk_offset_print = "${csv}${blk_offset}${csv}${delim}" if ($level > 0);

	print "${imagename_print}${partition_print}${filename_print}${istatus_print}${inode_print}${status_print}${blk_print}${blk_offset_print}${csv}${bytes}${csv}${delim}${csv}${string}${csv}\n";
	if ($log) {
		open (OUT, ">>$logfile") or die "couldn't open $logfile: $!\n";
		print OUT "${imagename_print}${partition_print}${filename_print}${istatus_print}${inode_print}${status_print}${blk_print}${blk_offset_print}${csv}${bytes}${csv}${delim}${csv}${string}${csv}\n";
		close OUT;
	}
}

sub print_group_inode {
	my ($log,$logfile,$file,$key,$filename,$istatus,$inode,$icat_cmd,$part_skip,$srch_strings_cmd,$srch_strings_args,$grep_srch_cmd) = @_;
	if ($log) {
		open (OUT, ">>$logfile") or die "couldn't open $logfile: $!\n";
	}
	print "\nIMAGE: $file, PARTITION: $key, FILE: $filename, INODE STATUS: $istatus, INODE: $inode\n";
	print OUT "\nIMAGE: $file, PARTITION: $key, FILE: $filename, INODE STATUS: $istatus, INODE: $inode\n" if ($log);
	print "\tFILE_OFFSET\tSTRING\n";
	print OUT "\tFILE_OFFSET\tSTRING\n" if ($log);
	my $ss_cmd = "$icat_cmd -o $part_skip $file $inode | $srch_strings_cmd $srch_strings_args $grep_srch_cmd";
	open (SS, "$ss_cmd |") or die "$ss_cmd: $!\n";
	while (<SS>) {
		print "\t$_"; 
		print OUT "\t$_" if ($log); 
	}
	close OUT;
	close SS;
}

sub print_group_block {
	my ($log,$logfile,$file,$key,$filename,$istatus,$inode,$blk,$blkcat_cmd,$part_skip,$srch_strings_cmd,$srch_strings_args,$grep_srch_cmd) = @_;
	if ($log) {
		open (OUT, ">>$logfile") or die "couldn't open $logfile: $!\n";
	}
	print "\nIMAGE: $file, PARTITION: $key, FILE: $filename, INODE STATUS: $istatus, INODE: $inode, BLOCK: $blk\n";
	print OUT "\nIMAGE: $file, PARTITION: $key, FILE: $filename, INODE STATUS: $istatus, INODE: $inode, BLOCK: $blk\n" if ($log);
	print "\tBLOCK_OFFSET\tSTRING\n";
	print OUT "\tBLOCK_OFFSET\tSTRING\n" if ($log);
	my $ss_cmd = "$blkcat_cmd -o $part_skip $file $blk | $srch_strings_cmd $srch_strings_args $grep_srch_cmd";
	open (SS, "$ss_cmd |") or die "$ss_cmd: $!\n";
	while (<SS>) {
		print "\t$_"; 
		print OUT "\t$_" if ($log); 
	}
	close OUT;
	close SS;
}

sub carve_inode {
	my ($output_dir,$file,$key,$filename,$inode,$icat_cmd,$istat_cmd,$part_skip) = @_;
	# check if type is file or directory	
	my $is_cmd = "$istat_cmd -o $part_skip $file $inode";
	open (STAT,"$is_cmd |") or die "$is_cmd: $!\n";
	my $type = "file";
	while (<STAT>) {
		next if (! /^mode: d/ && ! /^Flags.*Directory/ && ! /^File Attrib.*Directory/);
		$type = "dir";
	}

	# icat file/dir
	my $ic_cmd = "$icat_cmd -o $part_skip $file $inode";
	open (IN, "$ic_cmd |") or die "$ic_cmd: $!\n";	

	# fix image filename for output path
	$file =~ s/\//_/g;
	$file =~ s/^[^\w]+//g;
	$file =~ s/^[\._]+//g;
	
	$filename =~ s/^DELETED/\[deleted\]/;
	$key = "00" if ($key eq "N/A");

	my $dir;	
	if ($filename ne "") {
		if ($type eq "dir") {
			$dir = $filename;
			$filename = $filename . "/DIRECTORY_FILE";
		} else {
			$dir = dirname($filename);
		}
	}
	$filename = "FILENAME_NF" if ($filename eq "");

	my $root = "[root]";
	$root = "" if ($filename =~ /^\[deleted\]/);

        my $outfile = "$output_dir/$file/$key/$root/$filename";
	if ($filename eq "FILENAME_NF") {
        	$outfile = "$output_dir/$file/$key/[filename_unknown]/$filename.$inode";
		mkpath("$output_dir/$file/$key/[filename_unknown]");
	} else {
		mkpath("$output_dir/$file/$key/$root/$dir");
	}
	open (OUT, ">$outfile") or die "couldn't create output file $outfile: $!\n";
	print OUT join("",<IN>);
	close OUT;
	close IN;
}

sub carve_block {
	my ($output_dir,$file,$key,$filename,$inode,$blk,$blkcat_cmd,$part_skip) = @_;
	my $bc_cmd = "$blkcat_cmd -o $part_skip $file $blk";
	open (IN, "$bc_cmd |") or die "$bc_cmd: $!\n";	
	$file =~ s/\//_/g;
	$file =~ s/^[^\w]+//g;
	$file =~ s/^[\._]+//g;
	$key = "00" if ($key eq "N/A");
	my $dir = "[unallocated]";
	$dir = "[metadata]" if ($inode eq "Metadata");
	my $outfile = "$output_dir/$file/$key/$dir/block.$blk";
	mkpath("$output_dir/$file/$key/$dir");
	open (OUT, ">$outfile") or die "couldn't create output file $outfile: $!\n";
	print OUT join("",<IN>);
	close OUT;
	close IN;
}