hashdb_tools.h

Go to the documentation of this file.
00001 /*
00002  * The Sleuth Kit
00003  *
00004  * $Date: 2007/11/29 02:21:42 $
00005  *
00006  * Brian Carrier [carrier@sleuthkit.org]
00007  * Copyright (c) 2003-2007 Brian Carrier.  All rights reserved
00008  */
00009 
00015 #ifndef _TSK_HDB_TOOLS_H
00016 #define _TSK_HDB_TOOLS_H
00017 
00018 #include "aux_tools.h"
00019 
00020 #ifdef HAVE_UNISTD
00021 #include <unistd.h>
00022 #endif
00023 #include <string.h>
00024 #include <ctype.h>
00025 
00026 #include <sys/types.h>
00027 #include <sys/stat.h>
00028 
00029 #include <locale.h>
00030 
00031 #ifdef TSK_WIN32
00032 #include <io.h>
00033 #include <fcntl.h>
00034 #endif
00035 
00036 #ifdef __cplusplus
00037 extern "C" {
00038 #endif
00039 
00040 
00044     enum TSK_HDB_FLAG_ENUM {
00045         TSK_HDB_FLAG_QUICK = 0x01,      
00046         TSK_HDB_FLAG_EXT = 0x02 
00047     };
00048     typedef enum TSK_HDB_FLAG_ENUM TSK_HDB_FLAG_ENUM;
00049 
00050 
00054     enum TSK_HDB_HTYPE_ENUM {
00055         TSK_HDB_HTYPE_MD5_ID = 1,       
00056         TSK_HDB_HTYPE_SHA1_ID = 2,      
00057     };
00058     typedef enum TSK_HDB_HTYPE_ENUM TSK_HDB_HTYPE_ENUM;
00059 
00060 #define TSK_HDB_HTYPE_MD5_STR   "md5"   
00061 #define TSK_HDB_HTYPE_SHA1_STR  "sha1"  
00062 
00063 #define TSK_HDB_HTYPE_SHA1_LEN 40       
00064 #define TSK_HDB_HTYPE_MD5_LEN 32        
00065 #define TSK_HDB_HTYPE_CRC32_LEN 8       
00066 
00067 
00071 #define TSK_HDB_HTYPE_STR(x) \
00072     ( ((x) & TSK_HDB_HTYPE_MD5_ID) ? (TSK_HDB_HTYPE_MD5_STR) : ( \
00073         ( ((x) & TSK_HDB_HTYPE_SHA1_ID) ? TSK_HDB_HTYPE_SHA1_STR : "") ) )
00074 
00078 #define TSK_HDB_HTYPE_LEN(x) \
00079     ( ((x) & TSK_HDB_HTYPE_MD5_ID) ? (TSK_HDB_HTYPE_MD5_LEN) : ( \
00080         ( ((x) & TSK_HDB_HTYPE_SHA1_ID) ? TSK_HDB_HTYPE_SHA1_LEN : 0) ) )
00081 
00082 
00083 
00087     enum TSK_HDB_DBTYPE_ENUM {
00088         TSK_HDB_DBTYPE_NSRL_ID = 1,     
00089         TSK_HDB_DBTYPE_MD5SUM_ID = 2,   
00090         TSK_HDB_DBTYPE_HK_ID = 3,       
00091         TSK_HDB_DBTYPE_IDXONLY_ID = 4   
00092     };
00093     typedef enum TSK_HDB_DBTYPE_ENUM TSK_HDB_DBTYPE_ENUM;
00094 
00095 
00096 /* String versions of DB types */
00097 #define TSK_HDB_DBTYPE_NSRL_STR                 "nsrl"  
00098 #define TSK_HDB_DBTYPE_NSRL_MD5_STR             "nsrl-md5"      
00099 #define TSK_HDB_DBTYPE_NSRL_SHA1_STR            "nsrl-sha1"     
00100 #define TSK_HDB_DBTYPE_MD5SUM_STR               "md5sum"        
00101 #define TSK_HDB_DBTYPE_HK_STR                   "hk"    
00102 
00103 #define TSK_HDB_DBTYPE_SUPPORT_STR              "nsrl-md5, nsrl-sha1, md5sum, hk"
00104 
00105 
00106     typedef struct TSK_HDB_INFO TSK_HDB_INFO;
00107 
00108     typedef uint8_t(*TSK_HDB_LOOKUP_FN) (TSK_HDB_INFO *, char *hash,
00109                                          char *name, void *);
00110 
00115     struct TSK_HDB_INFO {
00116 
00117         TSK_TCHAR *db_fname;    
00118 
00119         TSK_TCHAR *uns_fname;   
00120 
00121         FILE *hDb;              
00122         FILE *hIdxTmp;          
00123         FILE *hIdx;             
00124 
00125         OFF_T idx_size;         
00126         uint16_t idx_off;       
00127         size_t idx_llen;        
00128         char *idx_lbuf;         
00129         TSK_TCHAR *idx_fname;   
00130 
00131         TSK_HDB_HTYPE_ENUM hash_type;   
00132         uint16_t hash_len;      
00133 
00134         TSK_HDB_DBTYPE_ENUM db_type;    
00135 
00136          uint8_t(*getentry) (TSK_HDB_INFO *, char *, OFF_T, TSK_HDB_FLAG_ENUM, TSK_HDB_LOOKUP_FN, void *);      
00137          uint8_t(*makeindex) (TSK_HDB_INFO *, TSK_TCHAR *);     
00138     };
00139 
00143     enum TSK_HDB_OPEN_ENUM {
00144         TSK_HDB_OPEN_NONE = 0,  
00145         TSK_HDB_OPEN_IDXONLY = (0x1 << 0)       
00146     };
00147     typedef enum TSK_HDB_OPEN_ENUM TSK_HDB_OPEN_ENUM;
00148 
00149 
00150     extern TSK_HDB_INFO *tsk_hdb_open(TSK_TCHAR * db_file,
00151                                       TSK_HDB_OPEN_ENUM flags);
00152     extern void tsk_hdb_close(TSK_HDB_INFO * hdb);
00153 
00154     extern uint8_t tsk_hdb_hasindex(TSK_HDB_INFO *, uint8_t htype);
00155 
00156 
00157 /* Functions */
00158     extern int8_t tsk_hdb_lookup(TSK_HDB_INFO *, char *, TSK_HDB_FLAG_ENUM,
00159                                  TSK_HDB_LOOKUP_FN, void *);
00160 
00161     extern int8_t tsk_hdb_lookup_raw(TSK_HDB_INFO *, uint8_t * hash,
00162                                      uint8_t len, TSK_HDB_FLAG_ENUM,
00163                                      TSK_HDB_LOOKUP_FN, void *);
00164 
00165 #ifdef __cplusplus
00166 }
00167 #endif
00168 #endif

Generated on Wed Nov 28 16:11:15 2007 for The Sleuth Kit (Incomplete) by  doxygen 1.5.1