#include "img_tools.h"
#include <sys/types.h>
Go to the source code of this file.
Data Structures | |
struct | TSK_FS_DENT |
Generic structure to store the file name information that is stored in a directory. More... | |
struct | TSK_FS_INODE_NAME_LIST |
Relatively generic structure to hold file names that are stored with the file metadata. More... | |
struct | TSK_FS_INODE |
Generic data strcture to hold file meta data. More... | |
struct | TSK_FS_INFO |
Stores state information for an open file system. More... | |
struct | TSK_FS_DATA_RUN |
Generic structure used to describe a run of consecutive blocks. More... | |
struct | TSK_FS_DATA |
Generic structure to hold attributes for files. More... | |
struct | TSK_FS_JENTRY |
Defines | |
#define | TSK_FS_DENT_TYPE_MAX_STR 15 |
Number of types that have a short string name. | |
#define | TSK_FS_INODE_NAME_LIST_NSIZE 512 |
Size of name array in TSK_FS_INODE_NAME_LIST structure. | |
#define | TSK_FS_ORPHAN_STR "-ORPHAN_FILE-" |
String that is prepended to orphan FAT & NTFS files when the file name is known, but the parent is not. | |
#define | TSK_FS_INODE_MODE_TYPE_SHIFT 12 |
Number of bits to shift mode to isolate file type. | |
#define | TSK_FS_INODE_MODE_TYPE_STR_MAX 15 |
Number of file types in shortname array. | |
#define | TSK_FS_ISDOT(str) |
#define | tsk_fs_read_random(fsi, buf, len, offs) (fsi)->img_info->read_random((fsi)->img_info, (fsi)->offset, (buf), (len), (offs)) |
#define | TSK_FS_DCALC_DD 0x1 |
#define | TSK_FS_DCALC_DLS 0x2 |
#define | TSK_FS_DCALC_SLACK 0x4 |
#define | TSK_FS_DCAT_HEX 0x1 |
#define | TSK_FS_DCAT_ASCII 0x2 |
#define | TSK_FS_DCAT_HTML 0x4 |
#define | TSK_FS_DCAT_STAT 0x8 |
#define | TSK_FS_DLS_CAT 0x01 |
#define | TSK_FS_DLS_LIST 0x02 |
#define | TSK_FS_DLS_SLACK 0x04 |
#define | TSK_FS_FFIND_ALL 0x1 |
#define | TSK_FS_FLS_DOT 0x001 |
#define | TSK_FS_FLS_LONG 0x002 |
#define | TSK_FS_FLS_FILE 0x004 |
#define | TSK_FS_FLS_DIR 0x008 |
#define | TSK_FS_FLS_FULL 0x010 |
#define | TSK_FS_FLS_MAC 0x020 |
#define | TSK_FS_IFIND_ALL 0x01 |
#define | TSK_FS_IFIND_PATH 0x04 |
#define | TSK_FS_IFIND_DATA 0x08 |
#define | TSK_FS_IFIND_PAR 0x10 |
#define | TSK_FS_IFIND_PAR_LONG 0x20 |
#define | TSK_FS_ILS_OPEN (1<<0) |
#define | TSK_FS_ILS_MAC (1<<1) |
#define | TSK_FS_ILS_LINK (1<<2) |
#define | TSK_FS_ILS_UNLINK (1<<3) |
Typedefs | |
typedef enum TSK_FS_INFO_TYPE_ENUM | TSK_FS_INFO_TYPE_ENUM |
typedef TSK_FS_INFO | TSK_FS_INFO |
typedef TSK_FS_DATA | TSK_FS_DATA |
typedef TSK_FS_DATA_RUN | TSK_FS_DATA_RUN |
typedef TSK_FS_INODE_NAME_LIST | TSK_FS_INODE_NAME_LIST |
typedef TSK_FS_JENTRY | TSK_FS_JENTRY |
typedef enum TSK_FS_DENT_FLAG_ENUM | TSK_FS_DENT_FLAG_ENUM |
typedef enum TSK_FS_DENT_TYPE_ENUM | TSK_FS_DENT_TYPE_ENUM |
typedef TSK_FS_DENT | TSK_FS_DENT |
typedef enum TSK_FS_INODE_FLAG_ENUM | TSK_FS_INODE_FLAG_ENUM |
typedef enum TSK_FS_INODE_ATTR_FLAG_ENUM | TSK_FS_INODE_ATTR_FLAG_ENUM |
typedef TSK_FS_INODE | TSK_FS_INODE |
typedef enum TSK_FS_INODE_MODE_ENUM | TSK_FS_INODE_MODE_ENUM |
typedef enum TSK_FS_BLOCK_FLAG_ENUM | TSK_FS_BLOCK_FLAG_ENUM |
typedef enum TSK_FS_FILE_FLAG_ENUM | TSK_FS_FILE_FLAG_ENUM |
typedef uint8_t(*) | TSK_FS_INODE_WALK_CB (TSK_FS_INFO *, TSK_FS_INODE *, void *) |
typedef uint8_t(*) | TSK_FS_BLOCK_WALK_CB (TSK_FS_INFO *, DADDR_T, char *, TSK_FS_BLOCK_FLAG_ENUM, void *) |
typedef uint8_t(*) | TSK_FS_DENT_TYPE_WALK_CB (TSK_FS_INFO *, TSK_FS_DENT *, void *) |
typedef uint8_t(*) | TSK_FS_FILE_WALK_CB (TSK_FS_INFO *, DADDR_T, char *, size_t, TSK_FS_BLOCK_FLAG_ENUM, void *) |
typedef uint8_t(*) | TSK_FS_JBLK_WALK_CB (TSK_FS_INFO *, char *, int, void *) |
typedef uint8_t(*) | TSK_FS_JENTRY_WALK_CB (TSK_FS_INFO *, TSK_FS_JENTRY *, int, void *) |
typedef enum TSK_FS_INFO_FLAG_ENUM | TSK_FS_INFO_FLAG_ENUM |
typedef enum TSK_FS_DATA_RUN_FLAG_ENUM | TSK_FS_DATA_RUN_FLAG_ENUM |
typedef enum TSK_FS_DATA_FLAG_ENUM | TSK_FS_DATA_FLAG_ENUM |
Enumerations | |
enum | TSK_FS_INFO_TYPE_ENUM { TSK_FS_INFO_TYPE_FS_MASK = 0xf0, TSK_FS_INFO_TYPE_SUB_MASK = 0x0f, TSK_FS_INFO_TYPE_UNSUPP = 0x00, TSK_FS_INFO_TYPE_FFS_TYPE = 0x10, TSK_FS_INFO_TYPE_FFS_1 = 0x11, TSK_FS_INFO_TYPE_FFS_1B = 0x12, TSK_FS_INFO_TYPE_FFS_2 = 0x13, TSK_FS_INFO_TYPE_FFS_AUTO = 0x14, TSK_FS_INFO_TYPE_EXT_TYPE = 0x20, TSK_FS_INFO_TYPE_EXT_2 = 0x21, TSK_FS_INFO_TYPE_EXT_3 = 0x22, TSK_FS_INFO_TYPE_EXT_AUTO = 0x23, TSK_FS_INFO_TYPE_FAT_TYPE = 0x30, TSK_FS_INFO_TYPE_FAT_12 = 0x31, TSK_FS_INFO_TYPE_FAT_16 = 0x32, TSK_FS_INFO_TYPE_FAT_32 = 0x33, TSK_FS_INFO_TYPE_FAT_AUTO = 0x34, TSK_FS_INFO_TYPE_NTFS_TYPE = 0x40, TSK_FS_INFO_TYPE_NTFS = 0x40, TSK_FS_INFO_TYPE_NTFS_AUTO = 0x40, TSK_FS_INFO_TYPE_SWAP_TYPE = 0x50, TSK_FS_INFO_TYPE_SWAP = 0x50, TSK_FS_INFO_TYPE_RAW_TYPE = 0x60, TSK_FS_INFO_TYPE_RAW = 0x60, TSK_FS_INFO_TYPE_ISO9660_TYPE = 0x70, TSK_FS_INFO_TYPE_ISO9660 = 0x70, TSK_FS_INFO_TYPE_HFS_TYPE = 0x80, TSK_FS_INFO_TYPE_HFS = 0x80 } |
Values for the file system type. More... | |
enum | TSK_FS_DENT_FLAG_ENUM { TSK_FS_DENT_FLAG_ALLOC = (1 << 0), TSK_FS_DENT_FLAG_UNALLOC = (1 << 1), TSK_FS_DENT_FLAG_RECURSE = (1 << 2) } |
File name flags that are used when walking directories and when specifying the status of a name in the TSK_FS_DENT structure. More... | |
enum | TSK_FS_DENT_TYPE_ENUM { TSK_FS_DENT_TYPE_UNDEF = 0, TSK_FS_DENT_TYPE_FIFO = 1, TSK_FS_DENT_TYPE_CHR = 2, TSK_FS_DENT_TYPE_DIR = 4, TSK_FS_DENT_TYPE_BLK = 6, TSK_FS_DENT_TYPE_REG = 8, TSK_FS_DENT_TYPE_LNK = 10, TSK_FS_DENT_TYPE_SOCK = 12, TSK_FS_DENT_TYPE_SHAD = 13, TSK_FS_DENT_TYPE_WHT = 14 } |
File type values -- as specified in the directory entry structure. More... | |
enum | TSK_FS_INODE_FLAG_ENUM { TSK_FS_INODE_FLAG_ALLOC = (1 << 0), TSK_FS_INODE_FLAG_UNALLOC = (1 << 1), TSK_FS_INODE_FLAG_USED = (1 << 2), TSK_FS_INODE_FLAG_UNUSED = (1 << 3), TSK_FS_INODE_FLAG_ORPHAN = (1 << 4), TSK_FS_INODE_FLAG_COMP = (1 << 5) } |
Metadata flags used in TSK_FS_INODE.flags and in request to inode_walk. More... | |
enum | TSK_FS_INODE_ATTR_FLAG_ENUM { TSK_FS_INODE_ATTR_EMPTY, TSK_FS_INODE_ATTR_STUDIED, TSK_FS_INODE_ATTR_ERROR } |
enum | TSK_FS_INODE_MODE_ENUM { TSK_FS_INODE_MODE_FMT = 0170000, TSK_FS_INODE_MODE_FIFO = 0010000, TSK_FS_INODE_MODE_CHR = 0020000, TSK_FS_INODE_MODE_DIR = 0040000, TSK_FS_INODE_MODE_BLK = 0060000, TSK_FS_INODE_MODE_REG = 0100000, TSK_FS_INODE_MODE_LNK = 0120000, TSK_FS_INODE_MODE_SHAD = 0130000, TSK_FS_INODE_MODE_SOCK = 0140000, TSK_FS_INODE_MODE_WHT = 0160000, TSK_FS_INODE_MODE_ISUID = 0004000, TSK_FS_INODE_MODE_ISGID = 0002000, TSK_FS_INODE_MODE_ISVTX = 0001000, TSK_FS_INODE_MODE_IRUSR = 0000400, TSK_FS_INODE_MODE_IWUSR = 0000200, TSK_FS_INODE_MODE_IXUSR = 0000100, TSK_FS_INODE_MODE_IRGRP = 0000040, TSK_FS_INODE_MODE_IWGRP = 0000020, TSK_FS_INODE_MODE_IXGRP = 0000010, TSK_FS_INODE_MODE_IROTH = 0000004, TSK_FS_INODE_MODE_IWOTH = 0000002, TSK_FS_INODE_MODE_IXOTH = 0000001 } |
Values for the mode field -- which identifies the file type and permissions. More... | |
enum | TSK_FS_BLOCK_FLAG_ENUM { TSK_FS_BLOCK_FLAG_ALLOC = (1 << 0), TSK_FS_BLOCK_FLAG_UNALLOC = (1 << 1), TSK_FS_BLOCK_FLAG_CONT = (1 << 2), TSK_FS_BLOCK_FLAG_META = (1 << 3), TSK_FS_BLOCK_FLAG_BAD = (1 << 4), TSK_FS_BLOCK_FLAG_ALIGN = (1 << 5), TSK_FS_BLOCK_FLAG_RES = (1 << 6), TSK_FS_BLOCK_FLAG_SPARSE = (1 << 7), TSK_FS_BLOCK_FLAG_COMP = (1 << 8) } |
Flags that are used when calling block_walk, in callback of of block_walk, and in callback of file_walk. More... | |
enum | TSK_FS_FILE_FLAG_ENUM { TSK_FS_FILE_FLAG_AONLY = (1 << 0), TSK_FS_FILE_FLAG_SLACK = (1 << 1), TSK_FS_FILE_FLAG_RECOVER = (1 << 2), TSK_FS_FILE_FLAG_META = (1 << 3), TSK_FS_FILE_FLAG_NOSPARSE = (1 << 4), TSK_FS_FILE_FLAG_NOID = (1 << 5) } |
Flags used when calling file_walk, the action of file_walk uses the TSK_FS_BLOCK_FLAG flags. More... | |
enum | TSK_FS_INFO_FLAG_ENUM { TSK_FS_INFO_FLAG_HAVE_SEQ = (1 << 0) } |
Flags for the FS_INFO structure. More... | |
enum | TSK_FS_DATA_RUN_FLAG_ENUM { TSK_FS_DATA_RUN_FLAG_FILLER = 0x1, TSK_FS_DATA_RUN_FLAG_SPARSE = 0x2 } |
Flags used for data runs in attributes (FS_DATA). More... | |
enum | TSK_FS_DATA_FLAG_ENUM { TSK_FS_DATA_INUSE = 0x1, TSK_FS_DATA_NONRES = 0x2, TSK_FS_DATA_RES = 0x4, TSK_FS_DATA_ENC = 0x10, TSK_FS_DATA_COMP = 0x20, TSK_FS_DATA_SPARSE = 0x40, TSK_FS_DATA_RECOVERY = 0x80 } |
Flags used for the TSK_FS_DATA structure, which is used to store attribute data. More... | |
Functions | |
TSK_FS_INFO_TYPE_ENUM | tsk_fs_parse_type (const TSK_TCHAR *) |
Parse a string (from the command line) and return the file system type id. | |
void | tsk_fs_print_types (FILE *) |
Print the supported file system types to a file handle. | |
char * | tsk_fs_get_type (TSK_FS_INFO_TYPE_ENUM) |
Return the string name of a file system type id. | |
TSK_FS_INODE * | tsk_fs_inode_alloc (int, int) |
Allocates a generic inode / metadata structure. | |
TSK_FS_INODE * | tsk_fs_inode_realloc (TSK_FS_INODE *, int, int) |
Resize an existing FS_INODE structure -- changes the number of block pointers. | |
void | tsk_fs_inode_free (TSK_FS_INODE *) |
Free the memory allocated to the FS_INODE structure. | |
TSK_FS_DATA * | tsk_fs_data_alloc (TSK_FS_DATA_FLAG_ENUM) |
Allocates and initializes a new structure. | |
TSK_FS_DATA_RUN * | tsk_fs_data_run_alloc () |
Allocate a run list entry. | |
TSK_FS_DATA * | tsk_fs_data_getnew_attr (TSK_FS_DATA *, TSK_FS_DATA_FLAG_ENUM) |
Given the begining of the list, return either an empty element in the list or a new one at the end. | |
void | tsk_fs_data_clear_list (TSK_FS_DATA *) |
Clear the fields and run_lists in the FS_DATA list. | |
TSK_FS_DATA * | tsk_fs_data_put_str (TSK_FS_DATA *, char *, uint32_t, uint16_t, void *, unsigned int) |
Copy resident data to an attribute in the list. | |
TSK_FS_DATA * | tsk_fs_data_put_run (TSK_FS_DATA *, OFF_T, TSK_FS_DATA_RUN *, char *, uint32_t, uint16_t, OFF_T, TSK_FS_DATA_FLAG_ENUM, uint32_t) |
Add a set of consecutive runs of an attribute of a specified type and id. | |
TSK_FS_DATA * | tsk_fs_data_lookup (TSK_FS_DATA *, uint32_t, uint16_t) |
Search the list of TSK_FS_DATA structures for an entry with a given type and id. | |
TSK_FS_DATA * | tsk_fs_data_lookup_noid (TSK_FS_DATA *, uint32_t) |
Search the list of TSK_FS_DATA structures for an entry with a given type (and ANY id). | |
void | tsk_fs_data_run_free (TSK_FS_DATA_RUN *) |
Free a list of data_runs. | |
void | tsk_fs_data_free (TSK_FS_DATA *) |
Free the list of TSK_FS_DATA structures and the runs that they allocated. | |
TSK_FS_DENT * | tsk_fs_dent_alloc (ULONG, ULONG) |
TSK_FS_DENT * | tsk_fs_dent_realloc (TSK_FS_DENT *, ULONG) |
void | tsk_fs_dent_free (TSK_FS_DENT *) |
void | tsk_fs_dent_print (FILE *, TSK_FS_DENT *, TSK_FS_INFO *, TSK_FS_DATA *) |
void | tsk_fs_dent_print_long (FILE *, TSK_FS_DENT *, TSK_FS_INFO *, TSK_FS_DATA *) |
void | tsk_fs_dent_print_mac (FILE *, TSK_FS_DENT *, TSK_FS_INFO *, TSK_FS_DATA *fs_data, char *) |
void | tsk_fs_make_ls (mode_t, char *) |
void | tsk_fs_print_day (FILE *, time_t) |
void | tsk_fs_print_time (FILE *, time_t) |
TSK_FS_INFO * | tsk_fs_open (TSK_IMG_INFO *, SSIZE_T, const TSK_TCHAR *) |
Tries to open data (at a given offset) as a file system. | |
SSIZE_T | tsk_fs_read_block (TSK_FS_INFO *, TSK_DATA_BUF *, OFF_T, DADDR_T) |
Read a file system block into a TSK_DATA_BUF structure. | |
SSIZE_T | tsk_fs_read_block_nobuf (TSK_FS_INFO *, char *, OFF_T, DADDR_T) |
Read a file system block into a char* buffer. | |
char * | tsk_fs_load_file (TSK_FS_INFO *, TSK_FS_INODE *, uint32_t, uint16_t, int) |
Load the contents of a file into a buffer. | |
SSIZE_T | tsk_fs_read_file (TSK_FS_INFO *, TSK_FS_INODE *, uint32_t, uint16_t, SSIZE_T, SSIZE_T, char *) |
Read the contents of a specific attribute of a file using a typical read() type interface. | |
SSIZE_T | tsk_fs_read_file_noid (TSK_FS_INFO *, TSK_FS_INODE *, SSIZE_T, SSIZE_T, char *) |
Read the contents of a file using a typical read() type interface. | |
int8_t | tsk_fs_dcalc (TSK_FS_INFO *fs, uint8_t lclflags, DADDR_T cnt) |
uint8_t | tsk_fs_dcat (TSK_FS_INFO *fs, uint8_t lclflags, DADDR_T addr, DADDR_T read_num_units) |
Read a specific number of blocks and print the contents to STDOUT. | |
uint8_t | tsk_fs_dls (TSK_FS_INFO *fs, uint8_t lclflags, DADDR_T bstart, DADDR_T bend, TSK_FS_BLOCK_FLAG_ENUM flags) |
uint8_t | tsk_fs_dstat (TSK_FS_INFO *fs, uint8_t lclflags, DADDR_T addr, TSK_FS_BLOCK_FLAG_ENUM flags) |
uint8_t | tsk_fs_ffind (TSK_FS_INFO *fs, uint8_t lclflags, INUM_T inode, uint32_t type, uint16_t id, int flags) |
uint8_t | tsk_fs_fls (TSK_FS_INFO *fs, uint8_t lclflags, INUM_T inode, int flags, TSK_TCHAR *pre, int32_t skew) |
uint8_t | tsk_fs_icat (TSK_FS_INFO *fs, uint8_t lclflags, INUM_T inum, uint32_t type, uint16_t id, int flags) |
int8_t | tsk_fs_ifind_path (TSK_FS_INFO *fs, uint8_t lclflags, TSK_TCHAR *path, INUM_T *result) |
Find the meta data address for a given file name. | |
uint8_t | tsk_fs_ifind_data (TSK_FS_INFO *fs, uint8_t lclflags, DADDR_T blk) |
uint8_t | tsk_fs_ifind_par (TSK_FS_INFO *fs, uint8_t lclflags, INUM_T par) |
uint8_t | tsk_fs_ils (TSK_FS_INFO *fs, uint8_t lclflags, INUM_T istart, INUM_T ilast, int flags, int32_t skew, TSK_TCHAR *img) |
Library API for inode walking. | |
uint8_t | fatfs_file_walk_off (TSK_FS_INFO *fs, TSK_FS_INODE *fs_inode, uint32_t type, uint16_t id, OFF_T a_st_off, TSK_FS_FILE_FLAG_ENUM flags, TSK_FS_FILE_WALK_CB action, void *ptr) |
Calls a callback function with the contents of each block in a file. | |
Variables | |
char | tsk_fs_dent_str [TSK_FS_DENT_TYPE_MAX_STR][2] |
char | tsk_fs_inode_mode_str [TSK_FS_INODE_MODE_TYPE_STR_MAX][2] |
Contains the short (1 character) name of the file type. |
#define TSK_FS_ISDOT | ( | str | ) |
Value:
( ((str[0] == '.') && \ ( ((str[1] == '.') && (str[2] == '\0')) || (str[1] == '\0') ) ) ? 1 : 0 )
Flags that are used when calling block_walk, in callback of of block_walk, and in callback of file_walk.
Flags used for the TSK_FS_DATA structure, which is used to store attribute data.
File name flags that are used when walking directories and when specifying the status of a name in the TSK_FS_DENT structure.
File type values -- as specified in the directory entry structure.
Flags used when calling file_walk, the action of file_walk uses the TSK_FS_BLOCK_FLAG flags.
Values for the file system type.
The most-significant nibble is the high-level type. The least-sigificant nibble is the specific sub-type of implementation.
Metadata flags used in TSK_FS_INODE.flags and in request to inode_walk.
Values for the mode field -- which identifies the file type and permissions.
uint8_t fatfs_file_walk_off | ( | TSK_FS_INFO * | fs, | |
TSK_FS_INODE * | fs_inode, | |||
uint32_t | type, | |||
uint16_t | id, | |||
OFF_T | a_st_off, | |||
TSK_FS_FILE_FLAG_ENUM | flags, | |||
TSK_FS_FILE_WALK_CB | action, | |||
void * | ptr | |||
) |
Calls a callback function with the contents of each block in a file.
Flags: TSK_FS_FILE_FLAG_SLACK, TSK_FS_FILE_FLAG_AONLY, TSK_FS_FILE_FLAG_RECOVER
no notion of NOSPARSE or META
flags on action: TSK_FS_BLOCK_FLAG_CONT, TSK_FS_BLOCK_FLAG_META, TSK_FS_BLOCK_FLAG_ALLOC, TSK_FS_BLOCK_FLAG_UNALLOC
fs | File system file is located in | |
fs_inode | File to read and analyze | |
type | Attribute type to read and analyze (does not apply to FAT) | |
id | Attribute id to read and analyze (does not apply to FAT) | |
a_st_off | Byte offset in the file to start calling the callback on (must be multiple of block size) | |
flags | Flags to use while reading | |
action | Callback function that is called for each block | |
ptr | Pointer to data that is passed to the callback |
TSK_FS_DATA* tsk_fs_data_alloc | ( | TSK_FS_DATA_FLAG_ENUM | type | ) |
Allocates and initializes a new structure.
type | The type of attribute to create (Resident or Non-resident) |
void tsk_fs_data_clear_list | ( | TSK_FS_DATA * | fs_data_head | ) |
Clear the fields and run_lists in the FS_DATA list.
fs_data_head | List of attributes to clear |
void tsk_fs_data_free | ( | TSK_FS_DATA * | fs_data_head | ) |
Free the list of TSK_FS_DATA structures and the runs that they allocated.
fs_data_head | List of structures to free. |
TSK_FS_DATA* tsk_fs_data_getnew_attr | ( | TSK_FS_DATA * | fs_data_head, | |
TSK_FS_DATA_FLAG_ENUM | type | |||
) |
Given the begining of the list, return either an empty element in the list or a new one at the end.
Preference is given to finding one of the same type to prevent excessive malloc's, but if one is not found then a different type is used: type = [TSK_FS_DATA_NONRES | TSK_FS_DATA_RES]
fs_data_head | Head of attribute list to search | |
type | Preference for attribute type to reuse |
TSK_FS_DATA* tsk_fs_data_lookup | ( | TSK_FS_DATA * | fs_data_head, | |
uint32_t | type, | |||
uint16_t | id | |||
) |
Search the list of TSK_FS_DATA structures for an entry with a given type and id.
fs_data_head | Head of fs_data list to search | |
type | Type of attribute to find | |
id | Id of attribute to find. If 0, then the lowest id of the given type is returned. |
TSK_FS_DATA* tsk_fs_data_lookup_noid | ( | TSK_FS_DATA * | fs_data_head, | |
uint32_t | type | |||
) |
Search the list of TSK_FS_DATA structures for an entry with a given type (and ANY id).
The attribute with the lowest id (or the named $Data attribute if that type is specified) is returned.
fs_data_head | Head of fs_data list to search | |
type | Type of attribute to find |
TSK_FS_DATA* tsk_fs_data_put_run | ( | TSK_FS_DATA * | fs_data_head, | |
OFF_T | runlen, | |||
TSK_FS_DATA_RUN * | data_run_new, | |||
char * | name, | |||
uint32_t | type, | |||
uint16_t | id, | |||
OFF_T | size, | |||
TSK_FS_DATA_FLAG_ENUM | flags, | |||
uint32_t | compsize | |||
) |
Add a set of consecutive runs of an attribute of a specified type and id.
This function first determines if the attribute exists and then either creates the attribute or adds to it. This is complicated because we could get the runs out of order so we use "filler" TSK_FS_DATA_RUN structures during the process
fs_data_head | The head of the list of attributes (or NULL if list is empty) | |
runlen | The total number of clusters in this set of runs. | |
data_run_new | The set of runs to add. This can be NULL only if it is the only run in the attribute. We use this special case for $Bad, but it should change. | |
name | Name of the attribute (in case it needs to be created) | |
type | Type of attribute to add run to | |
id | Id of attribute to add run to | |
size | Total size of the attribute (in case it needs to be created) | |
flags | Flags about compression, sparse etc. of data | |
compsize | Compression unit size (in case it needs to be created) |
TSK_FS_DATA* tsk_fs_data_put_str | ( | TSK_FS_DATA * | fs_data_head, | |
char * | name, | |||
uint32_t | type, | |||
uint16_t | id, | |||
void * | res_data, | |||
unsigned int | len | |||
) |
Copy resident data to an attribute in the list.
If no attributes exist yet, one will be created and the head of the resulting list will be returned.
fs_data_head | Head of the attribute list (or NULL if empty) | |
name | Name of the attribute to add | |
type | Type of the attribute to add | |
id | Id of the attribute to add | |
res_data | Pointer to where resident data is located (data will be copied from here into FS_DATA) | |
len | Length of resident data |
TSK_FS_DATA_RUN* tsk_fs_data_run_alloc | ( | ) |
Allocate a run list entry.
void tsk_fs_data_run_free | ( | TSK_FS_DATA_RUN * | fs_data_run | ) |
Free a list of data_runs.
fs_data_run | Head of list to free |
uint8_t tsk_fs_dcat | ( | TSK_FS_INFO * | fs, | |
uint8_t | lclflags, | |||
DADDR_T | addr, | |||
DADDR_T | read_num_units | |||
) |
Read a specific number of blocks and print the contents to STDOUT.
fs | File system to analyze | |
lclflags | flags | |
addr | Starting block address to read from | |
read_num_units | Number of blocks to read |
char* tsk_fs_get_type | ( | TSK_FS_INFO_TYPE_ENUM | ftype | ) |
Return the string name of a file system type id.
ftype | File system type id |
int8_t tsk_fs_ifind_path | ( | TSK_FS_INFO * | fs, | |
uint8_t | lclflags, | |||
TSK_TCHAR * | tpath, | |||
INUM_T * | result | |||
) |
Find the meta data address for a given file name.
fs | FS to analyze | |
lclflags | Flags for search | |
tpath | Path of file to search for | |
[out] | result | Meta data address of file |
uint8_t tsk_fs_ils | ( | TSK_FS_INFO * | fs, | |
uint8_t | lclflags, | |||
INUM_T | istart, | |||
INUM_T | ilast, | |||
int | flags, | |||
int32_t | skew, | |||
TSK_TCHAR * | img | |||
) |
Library API for inode walking.
fs | File system to analyze | |
lclflags | TSK_FS_ILS_XXX flag settings | |
istart | Starting inode address | |
ilast | Ending inode address | |
flags | Inode walk flags | |
skew | clock skew in seconds | |
img | Path to disk image name for header |
TSK_FS_INODE* tsk_fs_inode_alloc | ( | int | direct_count, | |
int | indir_count | |||
) |
Allocates a generic inode / metadata structure.
direct_count | Number of direct block address pointers to include in structure | |
indir_count | Number of indirect block address pointers to include in structure |
void tsk_fs_inode_free | ( | TSK_FS_INODE * | fs_inode | ) |
Free the memory allocated to the FS_INODE structure.
fs_inode | Structure to free |
TSK_FS_INODE* tsk_fs_inode_realloc | ( | TSK_FS_INODE * | fs_inode, | |
int | direct_count, | |||
int | indir_count | |||
) |
Resize an existing FS_INODE structure -- changes the number of block pointers.
fs_inode | Structure to resize | |
direct_count | Number of direct block address pointers to include in structure | |
indir_count | Number of indirect block address pointers to include in structure |
char* tsk_fs_load_file | ( | TSK_FS_INFO * | fs, | |
TSK_FS_INODE * | fsi, | |||
uint32_t | type, | |||
uint16_t | id, | |||
int | flags | |||
) |
Load the contents of a file into a buffer.
fs | The file system structure. | |
fsi | The inode structure of the file to read. | |
type | The type of attribute to load (ignored if TSK_FS_FILE_FLAG_NOID is given) | |
id | The id of attribute to load (ignored if TSK_FS_FILE_FLAG_NOID is given) | |
flags | Flag values of type TSK_FS_FILE_FLAG_* |
TSK_FS_INFO* tsk_fs_open | ( | TSK_IMG_INFO * | img_info, | |
SSIZE_T | offset, | |||
const TSK_TCHAR * | type | |||
) |
Tries to open data (at a given offset) as a file system.
Returns a structure that can be used for analysis and reporting.
img_info | Disk image to analyze | |
offset | Byte offset to start analyzing from | |
type | String type of file system type (autodetects if set to NULL) |
TSK_FS_INFO_TYPE_ENUM tsk_fs_parse_type | ( | const TSK_TCHAR * | str | ) |
Parse a string (from the command line) and return the file system type id.
str | File system type string |
void tsk_fs_print_types | ( | FILE * | hFile | ) |
Print the supported file system types to a file handle.
hFile | File handle to print to |
SSIZE_T tsk_fs_read_block | ( | TSK_FS_INFO * | fs, | |
TSK_DATA_BUF * | buf, | |||
OFF_T | len, | |||
DADDR_T | addr | |||
) |
Read a file system block into a TSK_DATA_BUF structure.
This is actually a wrapper around the fs_read_random function, but it allows the starting location to be specified as a block address.
fs | The file system structure. | |
buf | The buffer to store the block in. | |
len | The number of bytes to read (must be a multiple of the device block size) | |
addr | The starting block file system address. |
SSIZE_T tsk_fs_read_block_nobuf | ( | TSK_FS_INFO * | fs, | |
char * | buf, | |||
OFF_T | len, | |||
DADDR_T | addr | |||
) |
Read a file system block into a char* buffer.
This is actually a wrapper around the fs_read_random function, but it allows the starting location to be specified as a block address.
fs | The file system structure. | |
buf | The char * buffer to store the block in. | |
len | The number of bytes to read (must be a multiple of the device block size) | |
addr | The starting block file system address. |
SSIZE_T tsk_fs_read_file | ( | TSK_FS_INFO * | fs, | |
TSK_FS_INODE * | fsi, | |||
uint32_t | type, | |||
uint16_t | id, | |||
SSIZE_T | offset, | |||
SSIZE_T | size, | |||
char * | buf | |||
) |
Read the contents of a specific attribute of a file using a typical read() type interface.
fs | The file system structure. | |
fsi | The inode structure of the file to read. | |
type | The type of attribute to load | |
id | The id of attribute to load | |
offset | The byte offset to start reading from. | |
size | The number of bytes to read from the file. | |
buf | The buffer to read the data into. |
SSIZE_T tsk_fs_read_file_noid | ( | TSK_FS_INFO * | fs, | |
TSK_FS_INODE * | fsi, | |||
SSIZE_T | offset, | |||
SSIZE_T | size, | |||
char * | buf | |||
) |
Read the contents of a file using a typical read() type interface.
fs | The file system structure. | |
fsi | The inode structure of the file to read. | |
offset | The byte offset to start reading from. | |
size | The number of bytes to read from the file. | |
buf | The buffer to read the data into. |