libforensic1394  0.2.0
libforensic1394

The latest version of libforensic1394 can be found at: https://freddie.witherden.org/tools/libforensic1394/

This API gives you access to the FireWire bus of contemporary operating systems in order to facilitate digital forensics on an attached device. Unlike existing APIs Forensic1394 is:

By omitting features not required in forensic applications (such as isochronous transfers) the API is both simple to use and port. For example the memory of an attached device can be read using the following code:

char data[512];
// Allocate a bus handle
assert(bus);
// Enabls SBP-2; required for memory access to some systems
// Give the bus time to reinitialise
sleep(2);
// Get the devices attached to the systen
dev = forensic1394_get_devices(bus, NULL, NULL);
assert(dev);
// Open the first device
// Read some memory from the device
forensic1394_read_device(dev[0], 50 * 1024 * 1024, 512, data);
// Data now contains 512 bytes of memory starting at an offset of 50MiB
// Close the device and destroy the bus

Enabling SBP-2

In order to gain direct memory access to certain systems, namely Windows and GNU/Linux, it is necessary to present the target system with an SBP-2 unit directory. This can be done by calling forensic1394_enable_sbp2. It is usual for devices on the bus to take a couple of seconds to react to this change. Therefore, client applications should ideally wait for ~2 seconds before attempting to read or write to a device. Although there are provisions in the SBP-2 specification to determine when a target system has enabled the DMA filter, client-side API limitations currently prevent libforensic1394 from leveraging this.

Handling Bus Resets

Bus resets occur when devices are added/removed from the system or when the configuration ROM of a device is updated. The following methods are affected by bus resets:

After a bus reset calls to all of these methods will result in FORENSIC1394_RESULT_BUS_RESET being returned. Applications should handle this by saving the GUIDs of any devices being accessed and then call forensic1394_get_devices. Calling this will void all device handles. The new list of devices can then be iterated through and their GUIDs compared against saved GUIDs. The GUID of a device can be obtained by calling forensic1394_get_device_guid.

Thread Safety

libforensic1394 is thread safe at the device level with the restriction that devices can only be accessed by the thread that opened them. This is because some backends, namely Mac OS X/IOKit, install thread-specific callback dispatchers upon opening a device. When using multiple threads of execution care must be taken when calling forensic1394_get_devices (which closes and destroys any open device handles). It is the responsibility of the caller to ensure that this is safe. The process can be simplified through the use of an ondestroy callback handler.

Author
Freddie Witherden