swapfs.c File Reference


Detailed Description

General "swapfs" file system functions.

The "swap" file system is used to process an arbitrary chunk of data as 4096-byte pages that have no other structure. This means that you can use the data-level tools, but that is it. This is similar to the rawfs code, but a different block size. This is primarily intended for Unix systems that have a swap space partition.

#include "fs_tools_i.h"

Functions

uint8_t swapfs_inode_walk (TSK_FS_INFO *fs, INUM_T start_inum, INUM_T end_inum, TSK_FS_INODE_FLAG_ENUM flags, TSK_FS_INODE_WALK_CB action, void *ptr)
uint8_t swapfs_block_walk (TSK_FS_INFO *fs, DADDR_T start_blk, DADDR_T end_blk, TSK_FS_BLOCK_FLAG_ENUM flags, TSK_FS_BLOCK_WALK_CB action, void *ptr)
uint8_t swapfs_file_walk (TSK_FS_INFO *fs, TSK_FS_INODE *inode, uint32_t type, uint16_t id, TSK_FS_FILE_FLAG_ENUM flags, TSK_FS_FILE_WALK_CB action, void *ptr)
uint8_t swapfs_dent_walk (TSK_FS_INFO *fs, INUM_T inode, TSK_FS_DENT_FLAG_ENUM flags, TSK_FS_DENT_TYPE_WALK_CB action, void *ptr)
uint8_t swapfs_jopen (TSK_FS_INFO *fs, INUM_T inum)
uint8_t swapfs_jentry_walk (TSK_FS_INFO *fs, int flags, TSK_FS_JENTRY_WALK_CB action, void *ptr)
uint8_t swapfs_jblk_walk (TSK_FS_INFO *fs, INUM_T start, INUM_T end, int flags, TSK_FS_JBLK_WALK_CB action, void *ptr)
TSK_FS_INFOswapfs_open (TSK_IMG_INFO *img_info, SSIZE_T offset)
 Open part of a disk image as "swap" space.


Function Documentation

TSK_FS_INFO* swapfs_open ( TSK_IMG_INFO img_info,
SSIZE_T  offset 
)

Open part of a disk image as "swap" space.

This assumes no structure exists. Data are organized into 4096-byte pages.

Parameters:
img_info Disk image to analyze
offset Byte offset where swap space starts.
Returns:
NULL on error


Generated on Wed Nov 28 16:11:17 2007 for The Sleuth Kit (Incomplete) by  doxygen 1.5.1