Report recognized chunks

Author: e3krisztian

unblob/models.py

@@ -10,7 +10,7 @@
 
 from .file_utils import Endian, File, InvalidInputFormat, StructParser
 from .parser import hexstring2regex
-from .report import ErrorReport, Report
+from .report import ChunkReport, ErrorReport, Report
 
 logger = get_logger()
 
@@ -90,6 +90,16 @@ def extract(self, inpath: Path, outdir: Path):
 
         self.handler.extract(inpath, outdir)
 
+    def as_report(self, extraction_reports: List[Report]) -> ChunkReport:
+        return ChunkReport(
+            start_offset=self.start_offset,
+            end_offset=self.end_offset,
+            size=self.size,
+            handler_name=self.handler.NAME,
+            is_encrypted=self.is_encrypted,
+            extraction_reports=extraction_reports,
+        )
+
 
 @attr.define(repr=False)
 class UnknownChunk(Chunk):
@@ -125,7 +135,14 @@ def errors(self) -> List[ErrorReport]:
         reports = itertools.chain.from_iterable(
             r.reports for r in self.results
         )
-        return [r for r in reports if isinstance(r, ErrorReport)]
+        interesting_reports = (r for r in reports if isinstance(r, (ErrorReport, ChunkReport)))
+        errors = []
+        for report in interesting_reports:
+            if isinstance(report, ErrorReport):
+                errors.append(report)
+            else:
+                errors.extend(r for r in report.extraction_reports if isinstance(r, ErrorReport))
+        return errors
 
     def register(self, result: TaskResult):
         self.results.append(result)

unblob/processing.py

@@ -256,6 +256,7 @@ def _extract_chunk(self, file, chunk: ValidChunk):
             extract_dir = self.carve_dir / (inpath.name + self.config.extract_suffix)
             carved_path = inpath
 
+        extraction_reports = []
         try:
             chunk.extract(inpath, extract_dir)
 
@@ -264,12 +265,13 @@ def _extract_chunk(self, file, chunk: ValidChunk):
                 carved_path.unlink()
 
         except ExtractError as e:
-            for report in e.reports:
-                self.result.add_report(report)
+            extraction_reports.extend(e.reports)
 
         except Exception as exc:
             logger.exception("Unknown error happened while extracting chunk")
-            self.result.add_report(UnknownError(exception=exc))
+            extraction_reports.append(UnknownError(exception=exc))
+
+        self.result.add_report(chunk.as_report(extraction_reports))
 
         # we want to get consistent partial output even in case of unforeseen problems
         fix_extracted_directory(extract_dir, self.result)

unblob/report.py

@@ -143,8 +143,19 @@ def from_path(cls, path: Path):
 @attr.define(kw_only=True)
 class FileMagicReport(Report):
     magic: str
+    mime_type: str
 
     @classmethod
     def from_path(cls, path: Path):
         detected = magic.detect_from_filename(path)
-        return cls(magic=detected.name)
+        return cls(magic=detected.name, mime_type=detected.mime_type)
+
+
+@attr.define(kw_only=True)
+class ChunkReport(Report):
+    handler_name: str
+    start_offset: int
+    end_offset: int
+    size: int
+    is_encrypted: bool
+    extraction_reports: List[Report]

vulture_whitelist.py

@@ -5,6 +5,7 @@
 from unblob.file_utils import File, iterbits, round_down
 from unblob.models import _JSONEncoder
 from unblob.parser import _HexStringToRegex
+from unblob.report import ChunkReport
 
 _HexStringToRegex.literal
 _HexStringToRegex.wildcard
@@ -14,6 +15,8 @@
 
 _JSONEncoder.default
 
+ChunkReport.handler_name
+
 sys.breakpointhook
 cli.cli.context_class