mm_tools.h

Go to the documentation of this file.
00001 /*
00002  * The Sleuth Kit
00003  *
00004  * $Date: 2007/11/29 02:21:43 $
00005  *
00006  * Brian Carrier [carrier@sleuthkit.org]
00007  * Copyright (c) 2003-2005 Brian Carrier.  All rights reserved
00008  *
00009  */
00010 
00015 #ifndef _MM_TOOLS_H
00016 #define _MM_TOOLS_H
00017 
00018     /*
00019      * External interface.
00020      */
00021 #include "img_tools.h"
00022 #include <sys/types.h>
00023 
00024 
00025 
00026 #if defined(HAVE_UNISTD)
00027 #include <unistd.h>
00028 #endif
00029 
00030 #ifdef __cplusplus
00031 extern "C" {
00032 #endif
00033 
00034 
00035 
00036 /* Structures */
00037     typedef struct TSK_MM_INFO TSK_MM_INFO;
00038     typedef struct TSK_MM_PART TSK_MM_PART;
00039 
00040 /* walk action functions */
00041     typedef uint8_t(*TSK_MM_PART_WALK_CB) (TSK_MM_INFO *, PNUM_T,
00042         TSK_MM_PART *, int, void *);
00043 
00044 
00045 
00049     enum TSK_MM_INFO_TYPE_ENUM {
00050         TSK_MM_INFO_TYPE_UNSUPP = 0,    
00051         TSK_MM_INFO_TYPE_DOS = 1,       
00052         TSK_MM_INFO_TYPE_BSD = 2,       
00053         TSK_MM_INFO_TYPE_SUN = 3,       
00054         TSK_MM_INFO_TYPE_MAC = 4,       
00055         TSK_MM_INFO_TYPE_GPT = 5,       
00056     };
00057     typedef enum TSK_MM_INFO_TYPE_ENUM TSK_MM_INFO_TYPE_ENUM;
00058 
00059 
00060 /***************************************************************
00061  * TSK_MM_INFO: Allocated when a disk is opened
00062  */
00063     struct TSK_MM_INFO {
00064         TSK_IMG_INFO *img_info; 
00065         TSK_MM_INFO_TYPE_ENUM mmtype;   
00066         DADDR_T offset;         
00067         char *str_type;
00068         unsigned int block_size;
00069         unsigned int dev_bsize;
00070 
00071         /* endian ordering flag - values given in tsk_endian.h */
00072         uint8_t endian;
00073 
00074         TSK_MM_PART *part_list; /* linked list of partitions */
00075 
00076         PNUM_T first_part;      /* number of first partition */
00077         PNUM_T last_part;       /* number of last partition */
00078 
00079         /* media management type specific function pointers */
00080          uint8_t(*part_walk) (TSK_MM_INFO *, PNUM_T, PNUM_T, int,
00081             TSK_MM_PART_WALK_CB, void *);
00082         void (*close) (TSK_MM_INFO *);
00083     };
00084 
00085 
00086 
00087 
00088 /***************************************************************
00089  * Generic structures  for partitions / slices
00090  */
00091 
00095     enum TSK_MM_PART_TYPE_ENUM {
00096         TSK_MM_PART_TYPE_DESC = (1 << 0),       
00097         TSK_MM_PART_TYPE_VOL = (1 << 1) 
00098     };
00099     typedef enum TSK_MM_PART_TYPE_ENUM TSK_MM_PART_TYPE_ENUM;
00100 
00104     struct TSK_MM_PART {
00105         TSK_MM_PART *prev;      
00106         TSK_MM_PART *next;      
00107 
00108         DADDR_T start;          
00109         DADDR_T len;            
00110         char *desc;             
00111         int8_t table_num;       
00112         int8_t slot_num;        
00113         TSK_MM_PART_TYPE_ENUM type;     
00114     };
00115 
00116 
00117 
00118     extern uint8_t tsk_mm_part_unused(TSK_MM_INFO *);
00119     extern void tsk_mm_part_print(TSK_MM_INFO *);
00120     extern TSK_MM_PART *tsk_mm_part_add(TSK_MM_INFO *, DADDR_T, DADDR_T,
00121         TSK_MM_PART_TYPE_ENUM, char *, int8_t, int8_t);
00122     extern void tsk_mm_part_free(TSK_MM_INFO *);
00123 
00124     /***** TYPES *****/
00125     extern TSK_MM_INFO_TYPE_ENUM tsk_mm_parse_type(const TSK_TCHAR *);
00126     extern char *tsk_mm_get_type(TSK_MM_INFO_TYPE_ENUM);
00127 
00128 
00129 /**************************************************************8
00130  * Generic routines.
00131  */
00132     extern TSK_MM_INFO *tsk_mm_open(TSK_IMG_INFO *, DADDR_T,
00133         const TSK_TCHAR *);
00134     extern SSIZE_T tsk_mm_read_block_nobuf(TSK_MM_INFO *, char *, OFF_T,
00135         DADDR_T);
00136     extern void tsk_mm_print_types(FILE *);
00137 
00138     extern TSK_MM_INFO *tsk_mm_dos_open(TSK_IMG_INFO *, DADDR_T, uint8_t);
00139     extern TSK_MM_INFO *tsk_mm_mac_open(TSK_IMG_INFO *, DADDR_T);
00140     extern TSK_MM_INFO *tsk_mm_bsd_open(TSK_IMG_INFO *, DADDR_T);
00141     extern TSK_MM_INFO *tsk_mm_sun_open(TSK_IMG_INFO *, DADDR_T);
00142     extern TSK_MM_INFO *tsk_mm_gpt_open(TSK_IMG_INFO *, DADDR_T);
00143 
00144 
00145 // Endian macros - actual functions in misc/
00146 #define tsk_mm_guessu16(mm, x, mag)   \
00147         tsk_guess_end_u16(&(mm->endian), (x), (mag))
00148 
00149 #define tsk_mm_guessu32(mm, x, mag)   \
00150         tsk_guess_end_u32(&(mm->endian), (x), (mag))
00151 
00152 
00153 #ifdef __cplusplus
00154 }
00155 #endif
00156 #endif

Generated on Wed Nov 28 16:11:15 2007 for The Sleuth Kit (Incomplete) by  doxygen 1.5.1