mm_tools.h File Reference


Detailed Description

External header file for media management (volume system) support.

#include "img_tools.h"
#include <sys/types.h>

Go to the source code of this file.

Data Structures

struct  TSK_MM_INFO
struct  TSK_MM_PART
 Linked list entry that describes a volume in a generic way. More...

Defines

#define tsk_mm_guessu16(mm, x, mag)   tsk_guess_end_u16(&(mm->endian), (x), (mag))
#define tsk_mm_guessu32(mm, x, mag)   tsk_guess_end_u32(&(mm->endian), (x), (mag))

Typedefs

typedef TSK_MM_INFO TSK_MM_INFO
typedef TSK_MM_PART TSK_MM_PART
typedef uint8_t(*) TSK_MM_PART_WALK_CB (TSK_MM_INFO *, PNUM_T, TSK_MM_PART *, int, void *)
typedef enum TSK_MM_INFO_TYPE_ENUM TSK_MM_INFO_TYPE_ENUM
typedef enum TSK_MM_PART_TYPE_ENUM TSK_MM_PART_TYPE_ENUM

Enumerations

enum  TSK_MM_INFO_TYPE_ENUM {
  TSK_MM_INFO_TYPE_UNSUPP = 0, TSK_MM_INFO_TYPE_DOS = 1, TSK_MM_INFO_TYPE_BSD = 2, TSK_MM_INFO_TYPE_SUN = 3,
  TSK_MM_INFO_TYPE_MAC = 4, TSK_MM_INFO_TYPE_GPT = 5
}
 Flags for the partition type. More...
enum  TSK_MM_PART_TYPE_ENUM { TSK_MM_PART_TYPE_DESC = (1 << 0), TSK_MM_PART_TYPE_VOL = (1 << 1) }
 Flag values that describe the partitions in the VS. More...

Functions

uint8_t tsk_mm_part_unused (TSK_MM_INFO *)
void tsk_mm_part_print (TSK_MM_INFO *)
TSK_MM_PARTtsk_mm_part_add (TSK_MM_INFO *, DADDR_T, DADDR_T, TSK_MM_PART_TYPE_ENUM, char *, int8_t, int8_t)
void tsk_mm_part_free (TSK_MM_INFO *)
TSK_MM_INFO_TYPE_ENUM tsk_mm_parse_type (const TSK_TCHAR *)
char * tsk_mm_get_type (TSK_MM_INFO_TYPE_ENUM)
TSK_MM_INFO * tsk_mm_open (TSK_IMG_INFO *, DADDR_T, const TSK_TCHAR *)
 Open a disk image and process the media management system data.
SSIZE_T tsk_mm_read_block_nobuf (TSK_MM_INFO *, char *, OFF_T, DADDR_T)
void tsk_mm_print_types (FILE *)
TSK_MM_INFO * tsk_mm_dos_open (TSK_IMG_INFO *, DADDR_T, uint8_t)
TSK_MM_INFO * tsk_mm_mac_open (TSK_IMG_INFO *, DADDR_T)
TSK_MM_INFO * tsk_mm_bsd_open (TSK_IMG_INFO *, DADDR_T)
TSK_MM_INFO * tsk_mm_sun_open (TSK_IMG_INFO *, DADDR_T)
TSK_MM_INFO * tsk_mm_gpt_open (TSK_IMG_INFO *, DADDR_T)


Enumeration Type Documentation

enum TSK_MM_INFO_TYPE_ENUM

Flags for the partition type.

Enumerator:
TSK_MM_INFO_TYPE_UNSUPP  Unsupported.
TSK_MM_INFO_TYPE_DOS  DOS Partition table.
TSK_MM_INFO_TYPE_BSD  BSD Partition table.
TSK_MM_INFO_TYPE_SUN  Sun VTOC.
TSK_MM_INFO_TYPE_MAC  Mac partition table.
TSK_MM_INFO_TYPE_GPT  GPT partition table.

enum TSK_MM_PART_TYPE_ENUM

Flag values that describe the partitions in the VS.

Enumerator:
TSK_MM_PART_TYPE_DESC  Entry is for sectors of metadata.
TSK_MM_PART_TYPE_VOL  Entry is for sectors in a volume.


Function Documentation

TSK_MM_INFO* tsk_mm_open ( TSK_IMG_INFO img_info,
DADDR_T  offset,
const TSK_TCHAR *  type 
)

Open a disk image and process the media management system data.

This calls MM specific code to determine the type and collect data.

Parameters:
img_info The opened disk image.
offset Byte offset in the disk image to start analyzing from.
type String name of type specified by user (autodetect is used if this is NULL).
Returns:
NULL on error.


Generated on Wed Nov 28 16:11:18 2007 for The Sleuth Kit (Incomplete) by  doxygen 1.5.1