Currently used only for NTFS, but could be expanded to other file systems in the future.
#include "fs_tools_i.h"
#include "ntfs.h"
Functions | |
TSK_FS_DATA * | tsk_fs_data_alloc (TSK_FS_DATA_FLAG_ENUM type) |
Allocates and initializes a new structure. | |
TSK_FS_DATA_RUN * | tsk_fs_data_run_alloc () |
Allocate a run list entry. | |
void | tsk_fs_data_run_free (TSK_FS_DATA_RUN *fs_data_run) |
Free a list of data_runs. | |
void | tsk_fs_data_free (TSK_FS_DATA *fs_data_head) |
Free the list of TSK_FS_DATA structures and the runs that they allocated. | |
void | tsk_fs_data_clear_list (TSK_FS_DATA *fs_data_head) |
Clear the fields and run_lists in the FS_DATA list. | |
TSK_FS_DATA * | tsk_fs_data_getnew_attr (TSK_FS_DATA *fs_data_head, TSK_FS_DATA_FLAG_ENUM type) |
Given the begining of the list, return either an empty element in the list or a new one at the end. | |
TSK_FS_DATA * | tsk_fs_data_lookup (TSK_FS_DATA *fs_data_head, uint32_t type, uint16_t id) |
Search the list of TSK_FS_DATA structures for an entry with a given type and id. | |
TSK_FS_DATA * | tsk_fs_data_lookup_noid (TSK_FS_DATA *fs_data_head, uint32_t type) |
Search the list of TSK_FS_DATA structures for an entry with a given type (and ANY id). | |
TSK_FS_DATA * | tsk_fs_data_put_str (TSK_FS_DATA *fs_data_head, char *name, uint32_t type, uint16_t id, void *res_data, unsigned int len) |
Copy resident data to an attribute in the list. | |
TSK_FS_DATA * | tsk_fs_data_put_run (TSK_FS_DATA *fs_data_head, OFF_T runlen, TSK_FS_DATA_RUN *data_run_new, char *name, uint32_t type, uint16_t id, OFF_T size, TSK_FS_DATA_FLAG_ENUM flags, uint32_t compsize) |
Add a set of consecutive runs of an attribute of a specified type and id. |
TSK_FS_DATA* tsk_fs_data_alloc | ( | TSK_FS_DATA_FLAG_ENUM | type | ) |
Allocates and initializes a new structure.
type | The type of attribute to create (Resident or Non-resident) |
void tsk_fs_data_clear_list | ( | TSK_FS_DATA * | fs_data_head | ) |
Clear the fields and run_lists in the FS_DATA list.
fs_data_head | List of attributes to clear |
void tsk_fs_data_free | ( | TSK_FS_DATA * | fs_data_head | ) |
Free the list of TSK_FS_DATA structures and the runs that they allocated.
fs_data_head | List of structures to free. |
TSK_FS_DATA* tsk_fs_data_getnew_attr | ( | TSK_FS_DATA * | fs_data_head, | |
TSK_FS_DATA_FLAG_ENUM | type | |||
) |
Given the begining of the list, return either an empty element in the list or a new one at the end.
Preference is given to finding one of the same type to prevent excessive malloc's, but if one is not found then a different type is used: type = [TSK_FS_DATA_NONRES | TSK_FS_DATA_RES]
fs_data_head | Head of attribute list to search | |
type | Preference for attribute type to reuse |
TSK_FS_DATA* tsk_fs_data_lookup | ( | TSK_FS_DATA * | fs_data_head, | |
uint32_t | type, | |||
uint16_t | id | |||
) |
Search the list of TSK_FS_DATA structures for an entry with a given type and id.
fs_data_head | Head of fs_data list to search | |
type | Type of attribute to find | |
id | Id of attribute to find. If 0, then the lowest id of the given type is returned. |
TSK_FS_DATA* tsk_fs_data_lookup_noid | ( | TSK_FS_DATA * | fs_data_head, | |
uint32_t | type | |||
) |
Search the list of TSK_FS_DATA structures for an entry with a given type (and ANY id).
The attribute with the lowest id (or the named $Data attribute if that type is specified) is returned.
fs_data_head | Head of fs_data list to search | |
type | Type of attribute to find |
TSK_FS_DATA* tsk_fs_data_put_run | ( | TSK_FS_DATA * | fs_data_head, | |
OFF_T | runlen, | |||
TSK_FS_DATA_RUN * | data_run_new, | |||
char * | name, | |||
uint32_t | type, | |||
uint16_t | id, | |||
OFF_T | size, | |||
TSK_FS_DATA_FLAG_ENUM | flags, | |||
uint32_t | compsize | |||
) |
Add a set of consecutive runs of an attribute of a specified type and id.
This function first determines if the attribute exists and then either creates the attribute or adds to it. This is complicated because we could get the runs out of order so we use "filler" TSK_FS_DATA_RUN structures during the process
fs_data_head | The head of the list of attributes (or NULL if list is empty) | |
runlen | The total number of clusters in this set of runs. | |
data_run_new | The set of runs to add. This can be NULL only if it is the only run in the attribute. We use this special case for $Bad, but it should change. | |
name | Name of the attribute (in case it needs to be created) | |
type | Type of attribute to add run to | |
id | Id of attribute to add run to | |
size | Total size of the attribute (in case it needs to be created) | |
flags | Flags about compression, sparse etc. of data | |
compsize | Compression unit size (in case it needs to be created) |
TSK_FS_DATA* tsk_fs_data_put_str | ( | TSK_FS_DATA * | fs_data_head, | |
char * | name, | |||
uint32_t | type, | |||
uint16_t | id, | |||
void * | res_data, | |||
unsigned int | len | |||
) |
Copy resident data to an attribute in the list.
If no attributes exist yet, one will be created and the head of the resulting list will be returned.
fs_data_head | Head of the attribute list (or NULL if empty) | |
name | Name of the attribute to add | |
type | Type of the attribute to add | |
id | Id of the attribute to add | |
res_data | Pointer to where resident data is located (data will be copied from here into FS_DATA) | |
len | Length of resident data |
TSK_FS_DATA_RUN* tsk_fs_data_run_alloc | ( | ) |
Allocate a run list entry.
void tsk_fs_data_run_free | ( | TSK_FS_DATA_RUN * | fs_data_run | ) |
Free a list of data_runs.
fs_data_run | Head of list to free |