#include <fs_tools.h>
One of these are generated for each open files system and it contains file system-type specific data. These values are all filled in by the file system code and not the caller functions.
Data Fields | |
TSK_IMG_INFO * | img_info |
Pointer to the image layer state. | |
SSIZE_T | offset |
Byte offset into img_info that fs starts. | |
INUM_T | inum_count |
Number of inodes. | |
INUM_T | root_inum |
Address of root inode. | |
INUM_T | first_inum |
Address of first valid inode. | |
INUM_T | last_inum |
Address of last valid inode. | |
DADDR_T | block_count |
Number of blocks in fs. | |
DADDR_T | first_block |
Address of first block. | |
DADDR_T | last_block |
Address of last block as reported by file system (could be larger than last_block if end of image does not exist). | |
DADDR_T | last_block_act |
Address of last block -- adjusted so that it is equal to the last block in the image or volume (if image is not complete). | |
unsigned int | block_size |
Size of each block (in bytes). | |
unsigned int | dev_bsize |
Size of device block (typically always 512). | |
INUM_T | journ_inum |
Address of journal inode. | |
TSK_FS_INFO_TYPE_ENUM | ftype |
type of file system | |
char * | duname |
string "name" of data unit type | |
TSK_FS_INFO_FLAG_ENUM | flags |
flags for image | |
uint8_t | endian |
Endian order (see auxtools/tsk_endian.h). | |
TSK_LIST * | list_inum_named |
List of unallocated inodes that are pointed to by a file name -- Used to find orphans. | |
uint8_t(* | block_walk )(TSK_FS_INFO *fs, DADDR_T start, DADDR_T end, TSK_FS_BLOCK_FLAG_ENUM flags, TSK_FS_BLOCK_WALK_CB cb, void *ptr) |
Pointer to file system-specific function that passes a range of blocks to a callback function. | |
uint8_t(* | inode_walk )(TSK_FS_INFO *fs, INUM_T start, INUM_T end, TSK_FS_INODE_FLAG_ENUM flags, TSK_FS_INODE_WALK_CB cb, void *ptr) |
Pointer to file system-specific function that passes a range of inodes to a callback function. | |
TSK_FS_INODE *(* | inode_lookup )(TSK_FS_INFO *fs, INUM_T addr) |
Pointer to file system-specific function that looks up a file and returns the info in a generic format. | |
uint8_t(* | istat )(TSK_FS_INFO *fs, FILE *hFile, INUM_T inum, DADDR_T numblock, int32_t sec_skew) |
Pointer to file system specific function that prints details on a specific file to a file handle. | |
uint8_t(* | file_walk )(TSK_FS_INFO *fs, TSK_FS_INODE *fs_inode, uint32_t type, uint16_t id, TSK_FS_FILE_FLAG_ENUM flags, TSK_FS_FILE_WALK_CB cb, void *ptr) |
Pointer to a file system-specific function that calls a callback function with the contents of each block in a file. | |
uint8_t(* | dent_walk )(TSK_FS_INFO *fs, INUM_T inode, TSK_FS_DENT_FLAG_ENUM flags, TSK_FS_DENT_TYPE_WALK_CB action, void *ptr) |
Pointer to file system-specific function that processes the contents of a directory and passes each file name to a callback function. | |
uint8_t(* | jopen )(TSK_FS_INFO *, INUM_T) |
Open the journal. | |
uint8_t(* | jblk_walk )(TSK_FS_INFO *, DADDR_T, DADDR_T, int, TSK_FS_JBLK_WALK_CB, void *) |
Walk the blocks in a journal. | |
uint8_t(* | jentry_walk )(TSK_FS_INFO *, int, TSK_FS_JENTRY_WALK_CB, void *) |
Walk the entries in a journal. | |
uint8_t(* | fsstat )(TSK_FS_INFO *fs, FILE *hFile) |
Pointer to file system-specific function that prints file system details to a file handle. | |
uint8_t(* | fscheck )(TSK_FS_INFO *, FILE *) |
Check the integrity / sanity of the file system (not implemented). | |
void(* | close )(TSK_FS_INFO *fs) |
Pointer to file system-specific function that closes the file system and frees the allocated memory. |
uint8_t(* TSK_FS_INFO::block_walk)(TSK_FS_INFO *fs, DADDR_T start, DADDR_T end, TSK_FS_BLOCK_FLAG_ENUM flags, TSK_FS_BLOCK_WALK_CB cb, void *ptr) |
Pointer to file system-specific function that passes a range of blocks to a callback function.
fs | File system to analyze | |
start | Starting block in range to walk from | |
end | Ending block in range to walk to | |
flags | Flags for walking | |
cb | Callback function | |
ptr | Pointer to data that is passed to callback |
uint8_t(* TSK_FS_INFO::inode_walk)(TSK_FS_INFO *fs, INUM_T start, INUM_T end, TSK_FS_INODE_FLAG_ENUM flags, TSK_FS_INODE_WALK_CB cb, void *ptr) |
Pointer to file system-specific function that passes a range of inodes to a callback function.
fs | File system to analyze | |
start | Starting inode in range to walk from | |
end | Ending inode in range to walk to | |
flags | Flags for walking | |
cb | Callback function | |
ptr | Pointer to data that is passed to callback |
TSK_FS_INODE*(* TSK_FS_INFO::inode_lookup)(TSK_FS_INFO *fs, INUM_T addr) |
Pointer to file system-specific function that looks up a file and returns the info in a generic format.
fs | File system to analyze | |
addr | Metadata address of file to lookup |
uint8_t(* TSK_FS_INFO::istat)(TSK_FS_INFO *fs, FILE *hFile, INUM_T inum, DADDR_T numblock, int32_t sec_skew) |
Pointer to file system specific function that prints details on a specific file to a file handle.
fs | File system file is located in | |
hFile | File handle to print text to | |
inum | Address of file in file system | |
numblock | The number of blocks in file to force print (can go beyond file size) | |
sec_skew | Clock skew in seconds to also print times in |
uint8_t(* TSK_FS_INFO::file_walk)(TSK_FS_INFO *fs, TSK_FS_INODE *fs_inode, uint32_t type, uint16_t id, TSK_FS_FILE_FLAG_ENUM flags, TSK_FS_FILE_WALK_CB cb, void *ptr) |
Pointer to a file system-specific function that calls a callback function with the contents of each block in a file.
fs | File system file is located in | |
fs_inode | File to read and analyze | |
type | Attribute type to read and analyze (does not apply to all file systems) | |
id | Attribute id to read and analyze (does not apply to all file systems) | |
flags | Flags to use while reading | |
cb | Callback function that is called for each block | |
ptr | Pointer to data that is passed to the callback |
uint8_t(* TSK_FS_INFO::dent_walk)(TSK_FS_INFO *fs, INUM_T inode, TSK_FS_DENT_FLAG_ENUM flags, TSK_FS_DENT_TYPE_WALK_CB action, void *ptr) |
Pointer to file system-specific function that processes the contents of a directory and passes each file name to a callback function.
fs | File system to analyze | |
inode | Metadata address of directory to analyze | |
flags | Flags used during analysis | |
action | Callback function that is called for each file name | |
ptr | Pointer to data that is passed to callback |
uint8_t(* TSK_FS_INFO::fsstat)(TSK_FS_INFO *fs, FILE *hFile) |
Pointer to file system-specific function that prints file system details to a file handle.
fs | File system to print details on | |
hFile | File handle to print text to |
void(* TSK_FS_INFO::close)(TSK_FS_INFO *fs) |
Pointer to file system-specific function that closes the file system and frees the allocated memory.
fs | File system to close |