hfs.h

Go to the documentation of this file.
00001 /*
00002 ** The Sleuth Kit
00003 **
00004 ** This software is subject to the IBM Public License ver. 1.0,
00005 ** which was displayed prior to download and is included in the readme.txt
00006 ** file accompanying the Sleuth Kit files.  It may also be requested from:
00007 ** Crucial Security Inc.
00008 ** 14900 Conference Center Drive
00009 ** Chantilly, VA 20151
00010 **
00011 ** Wyatt Banks [wbanks@crucialsecurity.com]
00012 ** Copyright (c) 2005 Crucial Security Inc.  All rights reserved.
00013 **
00014 ** Brian Carrier [carrier@sleuthkit.org]
00015 ** Copyright (c) 2003-2005 Brian Carrier.  All rights reserved
00016 **
00017 ** Copyright (c) 1997,1998,1999, International Business Machines
00018 ** Corporation and others. All Rights Reserved.
00019 */
00020 
00021 /* TCT
00022  * LICENSE
00023  *      This software is distributed under the IBM Public License.
00024  * AUTHOR(S)
00025  *      Wietse Venema
00026  *      IBM T.J. Watson Research
00027  *      P.O. Box 704
00028  *      Yorktown Heights, NY 10598, USA
00029  --*/
00030 
00031 /*
00032 ** You may distribute the Sleuth Kit, or other software that incorporates
00033 ** part of all of the Sleuth Kit, in object code form under a license agreement,
00034 ** provided that:
00035 ** a) you comply with the terms and conditions of the IBM Public License
00036 **    ver 1.0; and
00037 ** b) the license agreement
00038 **     i) effectively disclaims on behalf of all Contributors all warranties
00039 **        and conditions, express and implied, including warranties or
00040 **        conditions of title and non-infringement, and implied warranties
00041 **        or conditions of merchantability and fitness for a particular
00042 **        purpose.
00043 **    ii) effectively excludes on behalf of all Contributors liability for
00044 **        damages, including direct, indirect, special, incidental and
00045 **        consequential damages such as lost profits.
00046 **   iii) states that any provisions which differ from IBM Public License
00047 **        ver. 1.0 are offered by that Contributor alone and not by any
00048 **        other party; and
00049 **    iv) states that the source code for the program is available from you,
00050 **        and informs licensees how to obtain it in a reasonable manner on or
00051 **        through a medium customarily used for software exchange.
00052 **
00053 ** When the Sleuth Kit or other software that incorporates part or all of
00054 ** the Sleuth Kit is made available in source code form:
00055 **     a) it must be made available under IBM Public License ver. 1.0; and
00056 **     b) a copy of the IBM Public License ver. 1.0 must be included with
00057 **        each copy of the program.
00058 */
00059 
00065 #ifndef _HFS_H
00066 #define _HFS_H
00067 
00068 
00069 /*
00070  * All structures created using technote 1150 from Apple.com
00071  * http://developer.apple.com/technotes/tn/tn1150.html
00072  */
00073 
00074 /*
00075  * Constants
00076  */
00077 
00078 #define HFS_MAGIC       0x4244  /* HX in big endian */
00079 #define HFSPLUS_MAGIC   0x482b  /* H+ in big endian */
00080 
00081 #define HFS_SBOFF       1024
00082 #define HFS_NDADDR      0001
00083 #define HFS_NIADDR      0001
00084 
00085 #define HFS_FIRST_USER_CNID     16
00086 
00087 /* b-tree kind types */
00088 #define HFS_BTREE_LEAF_NODE     -1
00089 #define HFS_BTREE_INDEX_NODE     0
00090 #define HFS_BTREE_HEADER_NODE    1
00091 #define HFS_BTREE_MAP_NODE       2
00092 
00093 #define HFS_MAXNAMLEN           255
00094 
00095 #define HFS_ROOT_INUM           2
00096 
00097 /* catalog file data types */
00098 #define HFS_FOLDER_RECORD       0x0001
00099 #define HFS_FILE_RECORD         0X0002
00100 #define HFS_FOLDER_THREAD       0x0003
00101 #define HFS_FILE_THREAD         0x0004
00102 
00103 /*
00104  * HFS uses its own time system, which is seconds since Jan 1 1904
00105  * instead of the typical Jan 1 1970.  This number is the seconds between
00106  * 1 Jan 1904 and 1 Jan 1970 which will make ctime(3) work instead of
00107  * re-writing the Apple library function to convert this time.
00108  */
00109 #define NSEC_BTWN_1904_1970     (uint32_t) 2082844800U
00110 
00111 #define HFS_BIT_VOLUME_UNMOUNTED        (uint32_t)(1 << 8)
00112 #define HFS_BIT_VOLUME_INCONSISTENT     (uint32_t)(1 << 11)
00113 #define HFS_BIT_VOLUME_JOURNALED        (uint32_t)(1 << 13)
00114 
00115 /*
00116  * HFS structures
00117  */
00118 
00119 /* File and Folder name struct */
00120 typedef struct {
00121     uint16_t length[2];
00122     uint16_t unicode[255];
00123 } hfs_uni_str;
00124 
00125 /* access permissions */
00126 typedef struct {
00127     uint8_t owner[4];           /* file owner */
00128     uint8_t group[4];           /* file group */
00129     uint8_t a_flags;            /* admin flags */
00130     uint8_t o_flags;            /* owner flags */
00131     uint8_t mode[2];            /* file mode */
00132     union {
00133         uint8_t inum[4];        /* inode number */
00134         uint8_t nlink[4];       /* link count */
00135         uint8_t raw[4];         /* raw device */
00136     } special;
00137 } hfs_access_perm;
00138 
00139 typedef struct {
00140     uint32_t uid;               /* owner id */
00141     uint32_t gid;               /* group id */
00142     uint32_t mode;              /* permissions */
00143     uint32_t dev;               /* special device */
00144 } hfs_file_perm;
00145 
00146 /* HFS extent descriptor */
00147 //typedef struct {
00148 struct hfs_ext_desc {
00149     uint8_t start_blk[4];       /* start block */
00150     uint8_t blk_cnt[4];         /* block count */
00151 };
00152 //} hfs_ext_desc;
00153 typedef struct hfs_ext_desc hfs_ext_desc;
00154 
00155 /* fork data structure */
00156 //typedef struct {
00157 struct hfs_fork {
00158     uint8_t logic_sz[8];        /* logical size */
00159     uint8_t clmp_sz[4];         /* clump size */
00160     uint8_t total_blk[4];       /* total blocks */
00161     hfs_ext_desc extents[8];
00162 };
00163 //} hfs_fork;
00164 typedef struct hfs_fork hfs_fork;
00165 
00166 /*
00167 ** Super Block
00168 */
00169 typedef struct {
00170     uint8_t signature[2];       /* "H+" for HFS+, "HX" for HFSX */
00171     uint8_t version[2];         /* 4 for HFS+, 5 for HFSX */
00172     uint8_t attr[4];            /* volume attributes */
00173     uint8_t last_mnt_ver[4];    /* last mounted version */
00174     uint8_t jinfo_blk[4];       /* journal info block */
00175     uint8_t c_date[4];          /* volume creation date */
00176     uint8_t m_date[4];          /* volume last modified date */
00177     uint8_t bkup_date[4];       /* volume last backup date */
00178     uint8_t chk_date[4];        /* date of last consistency check */
00179     uint8_t file_cnt[4];        /* number of files on volume */
00180     uint8_t fldr_cnt[4];        /* number of folders on volume */
00181     uint8_t blk_sz[4];          /* allocation block size */
00182     uint8_t blk_cnt[4];         /* number of blocks on disk */
00183     uint8_t free_blks[4];       /* unused block count */
00184     uint8_t next_alloc[4];      /* start of next allocation search */
00185     uint8_t rsrc_clmp_sz[4];    /* default clump size for resource forks */
00186     uint8_t data_clmp_sz[4];    /* default clump size for data forks */
00187     uint8_t next_cat_id[4];     /* next catalog id */
00188     uint8_t write_cnt[4];       /* write count */
00189     uint8_t enc_bmp[8];         /* encoding bitmap */
00190     uint8_t finder_info[32];
00191     hfs_fork alloc_file;        /* location and size of allocation file */
00192     hfs_fork ext_file;          /* location and size of extents file */
00193     hfs_fork cat_file;          /* location and size of catalog file */
00194     hfs_fork attr_file;         /* location and size of attributes file */
00195     hfs_fork start_file;        /* location and size of startup file */
00196 } hfs_sb;
00197 
00198 typedef struct {
00199     uint8_t key_len[2];
00200     uint8_t parent_cnid[4];
00201     uint8_t name[510];
00202 } hfs_cat_key;
00203 
00204 typedef struct {
00205     uint32_t inum;              /* inode number */
00206     uint32_t parent;            /* parent directoy number */
00207     uint32_t node;              /* btree leaf node */
00208     DADDR_T offs;               /* offset of beginning of inode */
00209 } htsk_fs_inode_mode_struct;
00210 
00211 typedef struct {
00212     uint8_t flink[4];           /* next node number */
00213     uint8_t blink[4];           /* previous node number */
00214     int8_t kind;                /* type of node */
00215     uint8_t height;             /* level in B-tree */
00216     uint8_t num_rec[2];         /* number of records this node */
00217     uint8_t res[2];             /* reserved */
00218 } hfs_btree_node;
00219 
00220 typedef struct {
00221     uint8_t depth[2];           /* current depth of btree */
00222     uint8_t root[4];            /* node number of root node */
00223     uint8_t leaf[4];            /* number of records in leaf nodes */
00224     uint8_t firstleaf[4];       /* number of first leaf node */
00225     uint8_t lastleaf[4];        /* number of last leaf node */
00226     uint8_t size[2];            /* byte size of leaf node (512..32768) */
00227     uint8_t max_len[2];         /* max key length in an index or leaf node */
00228     uint8_t total[4];           /* number of nodes in btree (free or in use) */
00229     uint8_t free[4];            /* unused nodes in btree */
00230     uint8_t res[2];             /* reserved */
00231     uint8_t clmp_sz[4];         /* clump size */
00232     uint8_t bt_type;            /* btree type */
00233     uint8_t k_type;             /* key compare type */
00234     uint8_t attr[4];            /* attributes */
00235     uint8_t res2[64];           /* reserved */
00236 } hfs_btree_header_record;
00237 
00238 typedef struct {
00239     int8_t v[2];
00240     int8_t h[2];
00241 } hfs_point;
00242 
00243 typedef struct {
00244     uint8_t file_type[4];       /* file type */
00245     uint8_t file_cr[4];         /* file creator */
00246     uint8_t flags[2];           /* finder flags */
00247     hfs_point loc;              /* location in the folder */
00248     uint8_t res[2];             /* reserved */
00249 } hfs_fileinfo;
00250 
00251 typedef struct {
00252     uint8_t res1[8];            /* reserved 1 */
00253     uint8_t extflags[2];        /* extended finder flags */
00254     uint8_t res2[2];            /* reserved 2 */
00255     uint8_t folderid[4];        /* putaway folder id */
00256 } hfs_extendedfileinfo;
00257 
00258 typedef struct {
00259     uint8_t rec_type[2];        /* record type */
00260     uint8_t flags[2];           /* flags - reserved */
00261     uint8_t valence[4];         /* valence - items in this folder */
00262     uint8_t cnid[4];            /* catalog node id */
00263     uint8_t ctime[4];           /* create date */
00264     uint8_t cmtime[4];          /* content mod date */
00265     uint8_t amtime[4];          /* attribute mod date */
00266     uint8_t atime[4];           /* access date */
00267     uint8_t bkup_time[4];       /* backup time */
00268     hfs_access_perm perm;       /* HFS permissions */
00269     hfs_fileinfo u_info;        /* user info */
00270     hfs_extendedfileinfo f_info;        /* finder info */
00271     uint8_t txt_enc[4];         /* text encoding */
00272     uint8_t res[4];             /* reserved */
00273 } hfs_folder;
00274 
00275 typedef struct {
00276     uint8_t rec_type[2];        /* record type */
00277     uint8_t flags[2];
00278     uint8_t res[4];             /* reserved */
00279     uint8_t cnid[4];            /* catalog node id */
00280     uint8_t ctime[4];           /* create date */
00281     uint8_t cmtime[4];          /* content modification date */
00282     uint8_t attr_mtime[4];      /* attribute mod date */
00283     uint8_t atime[4];           /* access date */
00284     uint8_t bkup_date[4];       /* backup date */
00285     hfs_access_perm perm;       /* permissions */
00286     hfs_fileinfo u_info;        /* user info */
00287     hfs_extendedfileinfo f_info;        /* finder info */
00288     uint8_t text_enc[4];        /* text encoding */
00289     uint8_t res2[4];            /* reserved 2 */
00290     hfs_fork data;              /* data fork */
00291     hfs_fork resource;          /* resource fork */
00292 } hfs_file;
00293 
00294 typedef struct {
00295     int16_t type;
00296     int16_t res;
00297     uint8_t cnid[4];
00298     char name[255];
00299 } hfs_thread;
00300 
00301 typedef struct {
00302     TSK_FS_INFO fs_info;        /* SUPER CLASS */
00303     hfs_sb *fs;                 /* cached superblock */
00304     TSK_FS_INODE *cat_inode;    /* contains the data entry for the cat */
00305 
00306     htsk_fs_inode_mode_struct *inodes;
00307     uint8_t *block_map;         /* cached block allocation bitmap */
00308     uint8_t *leaf_map;          /* bitmap of btree leaf nodes */
00309     uint8_t *del_map;           /* bitmap of btree deleted leaf nodes */
00310     hfs_file *cat;              /* cache for on-disk inode */
00311     int flags;                  /* flags for on-disk inode */
00312     INUM_T inum;                /* number of above cached cat */
00313 
00314     hfs_btree_header_record *hdr;       /* stored btree header node */
00315 
00316     OFF_T key;                  /* offset of key for cached inode */
00317 
00318 } HFS_INFO;
00319 
00320 /************** JOURNAL ******************/
00321 
00322 /* HFS Journal Info Block */
00323 typedef struct {
00324     uint8_t flags[4];
00325     uint8_t dev_sig[32];
00326     uint8_t offs[8];
00327     uint8_t size[8];
00328     uint8_t res[128];
00329 } hfs_journ_sb;
00330 
00331 /* 
00332  * Prototypes
00333  */
00334 extern uint8_t hfs_dent_walk(TSK_FS_INFO *, INUM_T, TSK_FS_DENT_FLAG_ENUM,
00335     TSK_FS_DENT_TYPE_WALK_CB, void *);
00336 extern uint8_t hfs_jopen(TSK_FS_INFO *, INUM_T);
00337 extern uint8_t hfs_jblk_walk(TSK_FS_INFO *, DADDR_T, DADDR_T, int,
00338     TSK_FS_JBLK_WALK_CB, void *);
00339 extern uint8_t hfs_jentry_walk(TSK_FS_INFO *, int, TSK_FS_JENTRY_WALK_CB,
00340     void *);
00341 #endif

Generated on Wed Nov 28 16:11:15 2007 for The Sleuth Kit (Incomplete) by  doxygen 1.5.1