Export carved files by command line

[MariasStory]

Hi team,
It would be nice to have an option to export the carved files to a separate location.
Is it possible from command line?
Can I do it on linux from command line?

[lfcnassif]

Hi. What do you mean by "curved files"?

[MariasStory]

HI @lfcnassif, sorry for the typo. (fixed)
I mean carved/recovered files.
I can export the files from the viewer. Just want to know if it is possible, or would be possible, to do it from command line.

[lfcnassif]

We don't have a sugar command line for that, but I think it is possible using the Web-API you noticed or a python script like this (just an example):

# First follow installation steps in https://pyjnius.readthedocs.io/en/stable/installation.html#
# You also must set environment variable CLASSPATH=c:\iped-xxx\iped.jar

from jnius import autoclass
File = autoclass('java.io.File')
IPEDSource = autoclass("iped.engine.data.IPEDSource")
iped = IPEDSource(File('E:\\case-folder'))

IPEDSearcher = autoclass("iped.engine.search.IPEDSearcher")
searcher = IPEDSearcher(iped)

# search for recovered files
searcher.setQuery("carved:true OR deleted:true")
ids = searcher.search().getIds()

# exporting files:
FileOutputStream = autoclass('java.io.FileOutputStream')
BufferedOutputStream = autoclass('java.io.BufferedOutputStream')
IOUtil = autoclass("iped.utils.IOUtil")

print("exporting " + str(ids.size()) + " items")

for i in range(ids.size()):
    id = ids.get(i)
    item = iped.getItemByID(id)

    # May cause issues with duplicated names, should be enhanced. IOUtil.getValidFilename() cleans Windows invalid names/chars:
    # outname = IOUtil.getValidFilename(item.getName())
    # outname = "F:\\test\\export-dir\\" + outname
    outname = "F:\\test\\export-dir\\" + str(id) + "." + item.getType()

    print("exporting " + item.getPath())

    inputStream = item.getBufferedInputStream()
    outputStream = BufferedOutputStream(FileOutputStream(File(outname)))
    try:
        IOUtil.copyInputToOutputStream(inputStream, outputStream)
    finally:
        inputStream.close()
        outputStream.close()

PS: Script updated to work with 4.x versions
PS2: Another example: #875

[lfcnassif]

I will move this to discussions to help others.