ext2fs.h

Go to the documentation of this file.
00001 /*
00002 ** The Sleuth Kit 
00003 **
00004 ** $Date: 2007/11/29 02:21:41 $
00005 **
00006 ** Brian Carrier [carrier@sleuthkit.org]
00007 ** Copyright (c) 2003-2005 Brian Carrier.  All rights reserved
00008 **
00009 ** TASK
00010 ** Copyright (c) 2002 Brian Carrier, @stake Inc.  All rights reserved
00011 ** 
00012 */
00013 
00018 #ifndef _EXT2FS_H
00019 #define _EXT2FS_H
00020 
00021 #ifdef __cplusplus
00022 extern "C" {
00023 #endif
00024 
00025     typedef uint32_t EXT2_GRPNUM_T;
00026 #define PRI_EXT2GRP     PRIu32
00027 
00028 /*
00029 ** Constants
00030 */
00031 #define EXT2FS_FIRSTINO    1    /* inode 1 contains the bad blocks */
00032 #define EXT2FS_ROOTINO     2    /* location of root directory inode */
00033 #define EXT2FS_NDADDR      12
00034 #define EXT2FS_NIADDR      3
00035 #define EXT2FS_SBOFF       1024
00036 #define EXT2FS_FS_MAGIC    0xef53
00037 #define EXT2FS_MAXNAMLEN        255
00038 #define EXT2FS_MAXPATHLEN       4096
00039 #define EXT2FS_MIN_BLOCK_SIZE   1024
00040 #define EXT2FS_MAX_BLOCK_SIZE   4096
00041 #define EXT2FS_DEV_BSIZE        512
00042 
00043 /*
00044 ** Super Block
00045 */
00046     typedef struct {
00047         uint8_t s_inodes_count[4];      /* u32 */
00048         uint8_t s_blocks_count[4];      /* u32 */
00049         uint8_t s_r_blocks_count[4];
00050         uint8_t s_free_blocks_count[4]; /* u32 */
00051         uint8_t s_free_inode_count[4];  /* u32 */
00052         uint8_t s_first_data_block[4];  /* u32 */
00053         uint8_t s_log_block_size[4];    /* u32 */
00054         uint8_t s_log_frag_size[4];     /* s32 */
00055         uint8_t s_blocks_per_group[4];  /* u32 */
00056         uint8_t s_frags_per_group[4];   /* u32 */
00057         uint8_t s_inodes_per_group[4];  /* u32 */
00058         uint8_t s_mtime[4];     /* u32 *//* mount time */
00059         uint8_t s_wtime[4];     /* u32 *//* write time */
00060         uint8_t s_mnt_count[2]; /* u16 *//* mount count */
00061         uint8_t s_max_mnt_count[2];     /* s16 */
00062         uint8_t s_magic[2];     /* u16 */
00063         uint8_t s_state[2];     /* u16 *//* fs state */
00064         uint8_t s_errors[2];    /* u16 */
00065         uint8_t s_minor_rev_level[2];   /* u16 */
00066         uint8_t s_lastcheck[4]; /* u32 */
00067         uint8_t s_checkinterval[4];     /* u32 */
00068         uint8_t s_creator_os[4];        /* u32 */
00069         uint8_t s_rev_level[4]; /* u32 */
00070         uint8_t s_def_resuid[2];        /* u16 */
00071         uint8_t s_def_resgid[2];        /* u16 */
00072         uint8_t s_first_ino[4]; /* u32 */
00073         uint8_t s_inode_size[2];        /* u16 */
00074         uint8_t s_block_group_nr[2];    /* u16 */
00075         uint8_t s_feature_compat[4];    /* u32 */
00076         uint8_t s_feature_incompat[4];  /* u32 */
00077         uint8_t s_feature_ro_compat[4]; /* u32 */
00078         uint8_t s_uuid[16];     /* u8[16] */
00079         char s_volume_name[16];
00080         char s_last_mounted[64];
00081         uint8_t s_algorithm_usage_bitmap[4];    /* u32 */
00082         uint8_t s_prealloc_blocks;      /* u8 */
00083         uint8_t s_prealloc_dir_blocks;  /* u8 */
00084         uint8_t s_padding1[2];  /* u16 */
00085         uint8_t s_journal_uuid[16];     /* u8[16] */
00086         uint8_t s_journal_inum[4];      /* u32 */
00087         uint8_t s_journal_dev[4];       /* u32 */
00088         uint8_t s_last_orphan[4];       /* u32 */
00089         uint8_t s_padding[788];
00090     } ext2fs_sb;
00091 
00092 /* File system State Values */
00093 #define EXT2FS_STATE_VALID      0x0001  /* unmounted correctly */
00094 #define EXT2FS_STATE_ERROR      0x0002  /* errors detected */
00095 
00096 /* Operating System Codes */
00097 #define EXT2FS_OS_LINUX         0
00098 #define EXT2FS_OS_HURD          1
00099 #define EXT2FS_OS_MASIX         2
00100 #define EXT2FS_OS_FREEBSD       3
00101 #define EXT2FS_OS_LITES         4
00102 
00103 /* Revision Levels */
00104 #define EXT2FS_REV_ORIG         0
00105 #define EXT2FS_REV_DYN          1
00106 
00107 /* feature flags */
00108 #define EXT2FS_FEATURE_COMPAT_DIR_PREALLOC      0x0001
00109 #define EXT2FS_FEATURE_COMPAT_IMAGIC_INODES     0x0002
00110 #define EXT2FS_FEATURE_COMPAT_HAS_JOURNAL       0x0004
00111 #define EXT2FS_FEATURE_COMPAT_EXT_ATTR          0x0008
00112 #define EXT2FS_FEATURE_COMPAT_RESIZE_INO        0x0010
00113 #define EXT2FS_FEATURE_COMPAT_DIR_INDEX         0x0020
00114 
00115 #define EXT2FS_FEATURE_INCOMPAT_COMPRESSION     0x0001
00116 #define EXT2FS_FEATURE_INCOMPAT_FILETYPE        0x0002
00117 #define EXT2FS_FEATURE_INCOMPAT_RECOVER         0x0004
00118 #define EXT2FS_FEATURE_INCOMPAT_JOURNAL_DEV     0x0008
00119 
00120 #define EXT2FS_FEATURE_RO_COMPAT_SPARSE_SUPER   0x0001
00121 #define EXT2FS_FEATURE_RO_COMPAT_LARGE_FILE             0x0002
00122 #define EXT2FS_FEATURE_RO_COMPAT_BTREE_DIR              0x0004
00123 
00124 
00125 
00126 /*
00127  * Group Descriptor
00128  */
00129     typedef struct {
00130         uint8_t bg_block_bitmap[4];     /* u32: block of blocks bitmap */
00131         uint8_t bg_inode_bitmap[4];     /* u32: block of inodes bitmap */
00132         uint8_t bg_inode_table[4];      /* u32: block of inodes table */
00133         uint8_t bg_free_blocks_count[2];        /* u16: num of free blocks */
00134         uint8_t bg_free_inodes_count[2];        /* u16: num of free inodes */
00135         uint8_t bg_used_dirs_count[2];  /* u16: num of use directories  */
00136         uint8_t f1[14];
00137     } ext2fs_gd;
00138 
00139 
00140 /* data address to group number */
00141 #define ext2_dtog_lcl(fsi, fs, d)       \
00142         (EXT2_GRPNUM_T)(((d) - tsk_getu32(fsi->endian, fs->s_first_data_block)) / \
00143         tsk_getu32(fsi->endian, fs->s_blocks_per_group))
00144 
00145 
00146 /* first fragment of group */
00147 #define ext2_cgbase_lcl(fsi, fs, c)     \
00148         ((DADDR_T)((tsk_getu32(fsi->endian, fs->s_blocks_per_group) * (c)) + \
00149         tsk_getu32(fsi->endian, fs->s_first_data_block)))
00150 
00151 
00152 /*
00153  * Inode
00154  */
00155     typedef struct {
00156         uint8_t i_mode[2];      /* u16 */
00157         uint8_t i_uid[2];       /* u16 */
00158         uint8_t i_size[4];      /* u32 */
00159         uint8_t i_atime[4];     /* u32 */
00160         uint8_t i_ctime[4];     /* u32 */
00161         uint8_t i_mtime[4];     /* u32 */
00162         uint8_t i_dtime[4];     /* u32 */
00163         uint8_t i_gid[2];       /* u16 */
00164         uint8_t i_nlink[2];     /* u16 */
00165         uint8_t i_nblk[4];
00166         uint8_t i_flags[4];
00167         uint8_t i_f5[4];
00168         uint8_t i_block[15][4]; /*s32 */
00169         uint8_t i_generation[4];
00170         uint8_t i_file_acl[4];
00171         uint8_t i_size_high[4]; /* u32 - also i_dir_acl for non-regular  */
00172         uint8_t i_faddr[4];
00173         uint8_t i_frag;
00174         uint8_t i_fsize;
00175         uint8_t f1[2];
00176         uint8_t i_uid_high[2];
00177         uint8_t i_gid_high[2];
00178         uint8_t f7[4];
00179     } ext2fs_inode;
00180 
00181 /* MODE */
00182 #define EXT2_IN_FMT  0017000
00183 #define EXT2_IN_SOCK 0140000
00184 #define EXT2_IN_LNK  0120000
00185 #define EXT2_IN_REG  0100000
00186 #define EXT2_IN_BLK  0060000
00187 #define EXT2_IN_DIR  0040000
00188 #define EXT2_IN_CHR  0020000
00189 #define EXT2_IN_FIFO  0010000
00190 
00191 #define EXT2_IN_SECDEL          0x00000001      /* Secure deletion */
00192 #define EXT2_IN_UNRM            0x00000002      /* Undelete */
00193 #define EXT2_IN_COMP            0x00000004      /* Compress file */
00194 #define EXT2_IN_SYNC            0x00000008      /* Synchronous updates */
00195 #define EXT2_IN_IMM                     0x00000010      /* Immutable file */
00196 #define EXT2_IN_APPEND          0x00000020      /* writes to file may only append */
00197 #define EXT2_IN_NODUMP          0x00000040      /* do not dump file */
00198 #define EXT2_IN_NOA                     0x00000080      /* do not update atime */
00199 
00200 
00201 
00202 /*
00203  * directory entries
00204  */
00205     typedef struct {
00206         uint8_t inode[4];       /* u32 */
00207         uint8_t rec_len[2];     /* u16 */
00208         uint8_t name_len[2];    /* u16 */
00209         char name[EXT2FS_MAXNAMLEN];
00210     } ext2fs_dentry1;
00211 
00212 /* new structure starting at 2.2 */
00213     typedef struct {
00214         uint8_t inode[4];       /* u32 */
00215         uint8_t rec_len[2];     /* u16 */
00216         uint8_t name_len;
00217         uint8_t type;
00218         char name[EXT2FS_MAXNAMLEN];
00219     } ext2fs_dentry2;
00220 
00221 #define EXT2FS_DIRSIZ_lcl(len) \
00222     ((len + 8 + 3) & ~(3))
00223 
00224 
00225 /* Ext2 directory file types (not the same as FFS. Sigh. */
00226 #define EXT2_DE_UNKNOWN         0
00227 #define EXT2_DE_REG_FILE        1
00228 #define EXT2_DE_DIR             2
00229 #define EXT2_DE_CHRDEV          3
00230 #define EXT2_DE_BLKDEV          4
00231 #define EXT2_DE_FIFO            5
00232 #define EXT2_DE_SOCK            6
00233 #define EXT2_DE_SYMLINK         7
00234 #define EXT2_DE_MAX             8
00235 
00236 
00237 #define EXT2_DE_V1      1
00238 #define EXT2_DE_V2      2
00239 
00240 
00241 
00242 
00243 /* Extended Attributes
00244  */
00245 
00246 #define EXT2_EA_MAGIC   0xEA020000
00247 
00248     typedef struct {
00249         uint8_t magic[4];
00250         uint8_t refcount[4];
00251         uint8_t blocks[4];
00252         uint8_t hash[4];
00253         uint8_t f1[16];
00254         uint8_t entry;
00255     } ext2fs_ea_header;
00256 
00257 
00258 #define EXT2_EA_IDX_USER                   1
00259 #define EXT2_EA_IDX_POSIX_ACL_ACCESS       2
00260 #define EXT2_EA_IDX_POSIX_ACL_DEFAULT      3
00261 #define EXT2_EA_IDX_TRUSTED                4
00262 #define EXT2_EA_IDX_LUSTRE                 5
00263 #define EXT2_EA_IDX_SECURITY               6
00264 
00265 /* Entries follow the header and are aligned to 4-byte boundaries 
00266  * the value of the attribute is stored at the bottom of the block 
00267  */
00268     typedef struct {
00269         uint8_t nlen;
00270         uint8_t nidx;
00271         uint8_t val_off[2];
00272         uint8_t val_blk[4];
00273         uint8_t val_size[4];
00274         uint8_t hash[4];
00275         uint8_t name;
00276     } ext2fs_ea_entry;
00277 
00278 #define EXT2_EA_LEN(nlen) \
00279         ((((nlen) + 19 ) / 4) * 4)
00280 
00281 
00282     typedef struct {
00283         uint8_t ver[4];
00284     } ext2fs_pos_acl_head;
00285 
00286 
00287 #define EXT2_PACL_TAG_USERO     0x01
00288 #define EXT2_PACL_TAG_USER      0x02
00289 #define EXT2_PACL_TAG_GRPO      0x04
00290 #define EXT2_PACL_TAG_GRP       0x08
00291 #define EXT2_PACL_TAG_MASK      0x10
00292 #define EXT2_PACL_TAG_OTHER     0x20
00293 
00294 
00295 #define EXT2_PACL_PERM_EXEC     0x01
00296 #define EXT2_PACL_PERM_WRITE    0x02
00297 #define EXT2_PACL_PERM_READ     0x04
00298 
00299 
00300     typedef struct {
00301         uint8_t tag[2];
00302         uint8_t perm[2];
00303     } ext2fs_pos_acl_entry_sh;
00304 
00305     typedef struct {
00306         uint8_t tag[2];
00307         uint8_t perm[2];
00308         uint8_t id[4];
00309     } ext2fs_pos_acl_entry_lo;
00310 
00311 
00312 
00313 
00314 /************** JOURNAL ******************/
00315 
00316 /* These values are always in big endian */
00317 
00318 #define EXT2_JMAGIC     0xC03b3998
00319 
00320     typedef struct {
00321         uint8_t magic[4];
00322         uint8_t entrytype[4];
00323         uint8_t entryseq[4];    /* sequence of this entry */
00324         uint8_t bsize[4];       /* size of block */
00325 
00326         uint8_t num_blk[4];     /* num of blks in journal */
00327         uint8_t first_blk[4];   /* bl where log starts */
00328         uint8_t start_seq[4];   /* first commit ID in log */
00329         uint8_t start_blk[4];   /* journ blk for 1st valid entry */
00330 
00331         uint8_t j_errno[4];     /* signed error number */
00332 
00333 /* the rest are not valid for v1 sb */
00334         uint8_t feature_compat[4];
00335         uint8_t feature_incompat[4];
00336         uint8_t feature_ro_incompat[4];
00337         uint8_t uuid[16];
00338         uint8_t num_fs[4];      /* num of fs sharing log */
00339         uint8_t dynsuper[4];    /* fs block of sb copy */
00340         uint8_t max_trans[4];   /* limit of blk per trans */
00341         uint8_t max_trans_data[4];      /* limit of data blocks per */
00342         uint8_t reserved[176];
00343         uint8_t id_fs[16][48];  /* Ids of fs sharing log */
00344     } ext2fs_journ_sb;
00345 
00346 
00347 #define EXT2_J_ETYPE_DESC       1       /* descriptor block */
00348 #define EXT2_J_ETYPE_COM        2       /* commit */
00349 #define EXT2_J_ETYPE_SB1        3       /* super block v1 */
00350 #define EXT2_J_ETYPE_SB2        4       /* sb v2 */
00351 #define EXT2_J_ETYPE_REV        5       /* revoke */
00352 
00353 
00354 /* Header that is used for all structures */
00355     typedef struct {
00356         uint8_t magic[4];
00357         uint8_t entry_type[4];
00358         uint8_t entry_seq[4];
00359     } ext2fs_journ_head;
00360 
00361 
00362 /* dentry flags */
00363 #define EXT2_J_DENTRY_ESC       1       /* The orig block starts with magic */
00364 #define EXT2_J_DENTRY_SAMEID    2       /* Entry is for same id, so do not skip 16 ahead */
00365 #define EXT2_J_DENTRY_DEL       4       /* not currently used in src */
00366 #define EXT2_J_DENTRY_LAST      8       /* Last tag */
00367 
00368 /* Entry in the descriptor table */
00369     typedef struct {
00370         uint8_t fs_blk[4];
00371         uint8_t flag[4];
00372     } ext2fs_journ_dentry;
00373 
00374 
00375 /* Journal Info */
00376     typedef struct {
00377 
00378         TSK_FS_INODE *fs_inode;
00379         INUM_T j_inum;
00380 
00381         uint32_t bsize;
00382         DADDR_T first_block;
00383         DADDR_T last_block;
00384 
00385         uint32_t start_seq;
00386         DADDR_T start_blk;
00387 
00388     } EXT2FS_JINFO;
00389 
00390 
00391 
00392     /*
00393      * Structure of an ext2fs file system handle.
00394      */
00395     typedef struct {
00396         TSK_FS_INFO fs_info;    /* super class */
00397         ext2fs_sb *fs;          /* super block */
00398 
00399         ext2fs_gd *grp_buf;     /* cached group descriptor */
00400         EXT2_GRPNUM_T grp_num;  /* cached group number */
00401 
00402         UCHAR *bmap_buf;        /* cached block allocation bitmap */
00403         EXT2_GRPNUM_T bmap_grp_num;     /* cached block bitmap nr */
00404 
00405         UCHAR *imap_buf;        /* cached inode allocation bitmap */
00406         EXT2_GRPNUM_T imap_grp_num;     /* cached inode bitmap nr */
00407 
00408         ext2fs_inode *dino_buf; /* cached disk inode */
00409         INUM_T dino_inum;       /* cached inode number */
00410 
00411         OFF_T groups_offset;    /* offset to first group desc */
00412         EXT2_GRPNUM_T groups_count;     /* nr of descriptor group blocks */
00413         uint8_t deentry_type;   /* v1 or v2 of dentry */
00414         uint16_t inode_size;    /* size of each inode */
00415         DADDR_T first_data_block;
00416 
00417         EXT2FS_JINFO *jinfo;
00418     } EXT2FS_INFO;
00419 
00420     extern uint8_t ext2fs_dent_walk(TSK_FS_INFO *, INUM_T,
00421         TSK_FS_DENT_FLAG_ENUM, TSK_FS_DENT_TYPE_WALK_CB, void *);
00422     extern uint8_t ext2fs_jentry_walk(TSK_FS_INFO *, int,
00423         TSK_FS_JENTRY_WALK_CB, void *);
00424     extern uint8_t ext2fs_jblk_walk(TSK_FS_INFO *, DADDR_T, DADDR_T, int,
00425         TSK_FS_JBLK_WALK_CB, void *);
00426     extern uint8_t ext2fs_jopen(TSK_FS_INFO *, INUM_T);
00427 
00428 #ifdef __cplusplus
00429 }
00430 #endif
00431 #endif

Generated on Wed Nov 28 16:11:14 2007 for The Sleuth Kit (Incomplete) by  doxygen 1.5.1