#include <fs_tools.h>
Attributes are a general term to describe any group of "data" -- it could be file contents or meta data. This structures are used currently only for NTFS because it has "multiple attributes", but it could be used for other FS in the future. These are grouped into an unsorted linked list.
Data Fields | |
TSK_FS_DATA * | next |
Pointer to next attribute in list. | |
TSK_FS_DATA_FLAG_ENUM | flags |
Flags for attribute. | |
char * | name |
Attribute name (could be NULL) (in UTF-8). | |
size_t | nsize |
Number of bytes allocated to name. | |
uint32_t | type |
Type of attribute. | |
uint16_t | id |
Id of attribute. | |
OFF_T | size |
Size in bytes of attribute. | |
TSK_FS_DATA_RUN * | run |
Linked list of runs for non-resident attributes. | |
TSK_FS_DATA_RUN * | run_end |
Pointer to final run in the list. | |
OFF_T | allocsize |
Number of bytes that are allocated in all clusters of non-resident run (will be larger than size). | |
uint32_t | compsize |
Size of compression units (needed only if file is compressed). | |
size_t | buflen |
Number of bytes allocated to resident buffer. | |
uint8_t * | buf |
Buffer for resident data. |