#!/bin/bash
#===============================================================================
#
# DIRECTORY:
#   /home/*/.local/share/nautilus/scripts/03-TSK/
# OR
#   /home/*/.gnome2/nautilus-sctipts/03-TSK/ (deprecated)
#
# FILE:
#   03-sigfind-ng
#
# USAGE:
#   Right klick on the first file of an EWF image (or RAW image) and
#   choose this nautilus script from the context menu.
#
# OPTIONS:
#   none
#
# DESCRIPTION:
#   Runs modified sigfind (The Sleuth Kit) by Rune Nordvik to find sectors
#   with possible GPT headers or VBRs with more precision.
#
# REQUIREMENTS:
#   bash, zenity, gnome-terminal, sigfind (modified) and procps
#
# BUGS:
#   ---
#
# NOTES:
#   Tested on
#   - Debian 8+
#   - Arch Linux
#
# AUTHOR:
#   Patrick Neumann, patrick@neumannsland.de
#
# COMPANY:
#   (privately)
#
# VERSION:
#   0.9 (beta)
#
# LINK TO THE MOST CURRENT VERSIONS:
#   https://
#
# CREATED:
#   24.03.2016
#
# COPYRIGHT (C):
#   2015-2020 - Patrick Neumann
#
# LICENSE:
#   This program is free software: you can redistribute it and/or modify
#   it under the terms of the GNU General Public License as published by
#   the Free Software Foundation, either version 3 of the License, or
#   (at your option) any later version.
#
# WARRANTY:
#   This program is distributed in the hope that it will be useful,
#   but WITHOUT ANY WARRANTY; without even the implied warranty of
#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#   GNU General Public License for more details.
#
#   You should have received a copy of the GNU General Public License
#   along with this program. If not, see <http://www.gnu.org/licenses/>.
#
# TODO:
#   ---
#
# HISTORY:
#   0.9 - Patrick Neumann - Initial (public) release
#
#===============================================================================

#-------------------------------------------------------------------------------
# Additional supported Distribution(s) (add before Library!).
#-------------------------------------------------------------------------------
SUPPORTED_OSR="arch"

#-------------------------------------------------------------------------------
# Check for library (casualscripter_nautilus-scripts_functions.sh).
#-------------------------------------------------------------------------------
readonly LIBRARY="${0%/*/*}/.casualscripter_nautilus-scripts_functions.sh"
if [ ! -f "${LIBRARY}" ] ; then
  zenity --error \
         --text \
         "ERROR: casualscripter_nautilus-scripts_functions.sh MISSING!"
  exit 1
fi

source "${LIBRARY}"

#-------------------------------------------------------------------------------
# Checks (see library "casualscripter_nautilus-scripts_functions.sh").
#-------------------------------------------------------------------------------
check_dep "${MMLS_BIN}" "sleuthkit"
check_dep "${GTERMINAL_BIN}" "gnome-terminal"
check_dep "${SLEEP_BIN}" "coreutils"
check_dep "${PGREP_BIN}" "procps"
check_dep "${BASENAME_BIN}" "coreutils"

# needs modified sigfind by Rune Nordvik
check_dep "${SIGFIND_BIN}" "sigfind"

if ! "${SIGFIND_BIN}" 2>&1 | "${GREP_BIN}" --fixed-strings "Nordvik" > /dev/null ; then
  ${ZENITY_BIN} --error \
                --text \
                "ERROR: modified sigfind by Rune Nordvik NOT found!"
  exit 1
fi

check_ext "${SOURCE}" "[eE]01|dd|DD|raw|RAW|img|IMG"

check_tmp

#-------------------------------------------------------------------------------
# Ask user for signature template.
#-------------------------------------------------------------------------------
multi_sigfind_tmpl() {
  ${ZENITY_BIN} --list \
                --text "Please select a template!" \
                --radiolist \
                --column "" \
                --column "Template (-t):" TRUE dospart FALSE gpt FALSE fat12or16 FALSE fat32 FALSE exfat FALSE ntfs FALSE hfsx FALSE apfs FALSE ext2 FALSE ext3 FALSE ext4 \
                --width="320" \
                --height="320"
}

readonly TEMPLATE="$( multi_sigfind_tmpl )"

if [ -z "${TEMPLATE}" ] ; then
  ${ZENITY_BIN} --error \
                --text \
                "ERROR: no template choosen!"
  exit 1
fi

#-------------------------------------------------------------------------------
# Run sigfind.
#-------------------------------------------------------------------------------
SIGFIND_TXT="${TMP}/sigfind_${TEMPLATE}_$( ${BASENAME_BIN} "${SOURCE%.*}" ).txt"
${GTERMINAL_BIN} --hide-menubar -- ${BASH_BIN} -c \
                 "${UNBUFFER_BIN} ${SIGFIND_BIN} -t '${TEMPLATE}' '${SOURCE}' \
                   | ${TEE_BIN} --append '${SIGFIND_TXT}'"
                           
${SLEEP_BIN} 3

# We have to wait until multi_sigfind has finished...
while ${PGREP_BIN} --full "${SIGFIND_BIN}" > /dev/null 2>&1; do
  ${SLEEP_BIN} 1
done

#-------------------------------------------------------------------------------
# Display content of the resultfile "sigfind...txt".
#-------------------------------------------------------------------------------
display_resultfile "${SIGFIND_TXT}"

exit 0