fatfs.h

Go to the documentation of this file.
00001 /*
00002 ** The Sleuth Kit 
00003 **
00004 ** $Date: 2007/11/29 02:21:41 $
00005 **
00006 ** Brian Carrier [carrier@sleuthkit.org]
00007 ** Copyright (c) 2003-2005 Brian Carrier.  All rights reserved
00008 **
00009 ** TASK
00010 ** Copyright (c) 2002 @stake Inc.  All rights reserved
00011 **
00012 ** This software is distributed under the Common Public License 1.0
00013 **
00014 */
00020 #ifndef _FATFS_H
00021 #define _FATFS_H
00022 
00023 #ifdef __cplusplus
00024 extern "C" {
00025 #endif
00026 
00027 /*
00028 ** Constants
00029 */
00030 #define FATFS_ROOTINO   2       /* location of root directory inode */
00031 #define FATFS_FIRSTINO  2
00032 
00033 /* The following two values do not have the same meaning as they do in
00034  * TSK_FS_INFO_TYPE_EXT_2 and FFS because there is no notion of indirect pointers.  
00035  * we will assign the first cluster to direct_addr[0] and that is it
00036  */
00037 #define FATFS_NDADDR    2
00038 #define FATFS_NIADDR    0
00039 #define FATFS_DEV_BSIZE 512
00040 #define FATFS_SBOFF             0
00041 #define FATFS_FS_MAGIC  0xaa55
00042 #define FATFS_MAXNAMLEN 256
00043 #define FATFS_MAXNAMLEN_UTF8    1024
00044 
00045 /* size of FAT to read into FATFS_INFO each time */
00046 /* This must be at least 1024 bytes or else fat12 will get messed up */
00047 #define FAT_CACHE_N             4       // number of caches
00048 #define FAT_CACHE_B             4096
00049 #define FAT_CACHE_S             8       // number of sectors in cache
00050 
00051 /* MASK values for FAT entries */
00052 #define FATFS_12_MASK   0x00000fff
00053 #define FATFS_16_MASK   0x0000ffff
00054 #define FATFS_32_MASK   0x0fffffff
00055 
00056 /* Constants for the FAT entry */
00057 #define FATFS_UNALLOC   0
00058 #define FATFS_BAD               0x0ffffff7
00059 #define FATFS_EOFS              0x0ffffff8
00060 #define FATFS_EOFE              0x0fffffff
00061 
00062 
00063 
00064 /* macro to identify if the FAT value is End of File
00065  * returns 1 if it is and 0 if it is not 
00066  */
00067 #define FATFS_ISEOF(val, mask)  \
00068         ((val >= (FATFS_EOFS & mask)) && (val <= (FATFS_EOFE)))
00069 
00070 
00071 #define FATFS_ISBAD(val, mask) \
00072         ((val) == (FATFS_BAD & mask))
00073 
00074 
00075 #define FATFS_CLUST_2_SECT(fatfs, c)    \
00076         (DADDR_T)(fatfs->firstclustsect + ((((c) & fatfs->mask) - 2) * fatfs->csize))
00077 
00078 #define FATFS_SECT_2_CLUST(fatfs, s)    \
00079         (DADDR_T)(2 + ((s)  - fatfs->firstclustsect) / fatfs->csize)
00080 
00081 
00082 
00083 /* given an inode address, determine in which sector it is located
00084  * i must be larger than 3 (2 is the root and it doesn't have a sector)
00085  */
00086 #define FATFS_INODE_2_SECT(fatfs, i)    \
00087     (DADDR_T)((i - 3)/(fatfs->dentry_cnt_se) + fatfs->firstdatasect)
00088 
00089 #define FATFS_INODE_2_OFF(fatfs, i)     \
00090     (unsigned int)(((i - 3) % fatfs->dentry_cnt_se) * sizeof(fatfs_dentry))
00091 
00092 
00093 
00094 /* given a sector IN THE DATA AREA, return the base inode for it */
00095 #define FATFS_SECT_2_INODE(fatfs, s)    \
00096     (INUM_T)((s - fatfs->firstdatasect) * fatfs->dentry_cnt_se + 3)
00097 
00098 
00099 
00100 /*
00101  * Boot Sector Structure for TSK_FS_INFO_TYPE_FAT_12, TSK_FS_INFO_TYPE_FAT_16, and TSK_FS_INFO_TYPE_FAT_32
00102  */
00103     typedef struct {
00104         uint8_t f1[3];
00105         char oemname[8];
00106         uint8_t ssize[2];       /* sector size in bytes */
00107         uint8_t csize;          /* cluster size in sectors */
00108         uint8_t reserved[2];    /* number of reserved sectors for boot sectors */
00109         uint8_t numfat;         /* Number of FATs */
00110         uint8_t numroot[2];     /* Number of Root dentries */
00111         uint8_t sectors16[2];   /* number of sectors in FS */
00112         uint8_t f2[1];
00113         uint8_t sectperfat16[2];        /* size of FAT */
00114         uint8_t f3[4];
00115         uint8_t prevsect[4];    /* number of sectors before FS partition */
00116         uint8_t sectors32[4];   /* 32-bit value of number of FS sectors */
00117 
00118         /* The following are different for fat12/fat16 and fat32 */
00119         union {
00120             struct {
00121                 uint8_t f5[3];
00122                 uint8_t vol_id[4];
00123                 uint8_t vol_lab[11];
00124                 uint8_t fs_type[8];
00125                 uint8_t f6[448];
00126             } f16;
00127             struct {
00128                 uint8_t sectperfat32[4];
00129                 uint8_t ext_flag[2];
00130                 uint8_t fs_ver[2];
00131                 uint8_t rootclust[4];   /* cluster where root directory is stored */
00132                 uint8_t fsinfo[2];      /* TSK_FS_INFO Location */
00133                 uint8_t bs_backup[2];   /* sector of backup of boot sector */
00134                 uint8_t f5[12];
00135                 uint8_t drvnum;
00136                 uint8_t f6[2];
00137                 uint8_t vol_id[4];
00138                 uint8_t vol_lab[11];
00139                 uint8_t fs_type[8];
00140                 uint8_t f7[420];
00141             } f32;
00142         } a;
00143 
00144         uint8_t magic[2];       /* MAGIC for all versions */
00145 
00146     } fatfs_sb;
00147 
00148     typedef struct {
00149         uint8_t magic1[4];      /* 41615252 */
00150         uint8_t f1[480];
00151         uint8_t magic2[4];      /* 61417272 */
00152         uint8_t freecnt[4];     /* free clusters 0xfffffffff if unknown */
00153         uint8_t nextfree[4];    /* next free cluster */
00154         uint8_t f2[12];
00155         uint8_t magic3[4];      /* AA550000 */
00156     } fatfs_fsinfo;
00157 
00158 
00159 
00160 /* directory entry short name structure */
00161     typedef struct {
00162         uint8_t name[8];
00163         uint8_t ext[3];
00164         uint8_t attrib;
00165         uint8_t lowercase;
00166         uint8_t ctimeten;       /* create times */
00167         uint8_t ctime[2];
00168         uint8_t cdate[2];
00169         uint8_t adate[2];       /* access time */
00170         uint8_t highclust[2];
00171         uint8_t wtime[2];       /* last write time */
00172         uint8_t wdate[2];
00173         uint8_t startclust[2];
00174         uint8_t size[4];
00175     } fatfs_dentry;
00176 
00177 
00178 /* Macro to combine the upper and lower 2-byte parts of the starting
00179  * cluster 
00180  */
00181 #define FATFS_DENTRY_CLUST(fsi, de)     \
00182         (DADDR_T)((tsk_getu16(fsi->endian, de->startclust)) | (tsk_getu16(fsi->endian, de->highclust)<<16))
00183 
00184 /* constants for first byte of name[] */
00185 #define FATFS_SLOT_EMPTY        0x00
00186 #define FATFS_SLOT_E5           0x05    /* actual value is 0xe5 */
00187 #define FATFS_SLOT_DELETED      0xe5
00188 
00189 /* 
00190  *Return 1 if c is an valid charactor for a short file name 
00191  *
00192  * NOTE: 0x05 is allowed in name[0], and 0x2e (".") is allowed for name[0]
00193  * and name[1] and 0xe5 is allowed for name[0]
00194  */
00195 
00196 #define FATFS_IS_83_NAME(c)             \
00197         ((((c) < 0x20) || \
00198           ((c) == 0x22) || \
00199           (((c) >= 0x2a) && ((c) <= 0x2c)) || \
00200           ((c) == 0x2e) || \
00201           ((c) == 0x2f) || \
00202           (((c) >= 0x3a) && ((c) <= 0x3f)) || \
00203           (((c) >= 0x5b) && ((c) <= 0x5d)) || \
00204           ((c) == 0x7c)) == 0)
00205 
00206 
00207 
00208 /* flags for attributes field */
00209 #define FATFS_ATTR_NORMAL       0x00    /* normal file */
00210 #define FATFS_ATTR_READONLY     0x01    /* file is readonly */
00211 #define FATFS_ATTR_HIDDEN       0x02    /* file is hidden */
00212 #define FATFS_ATTR_SYSTEM       0x04    /* file is a system file */
00213 #define FATFS_ATTR_VOLUME       0x08    /* entry is a volume label */
00214 #define FATFS_ATTR_DIRECTORY    0x10    /* entry is a directory name */
00215 #define FATFS_ATTR_ARCHIVE      0x20    /* file is new or modified */
00216 #define FATFS_ATTR_LFN          0x0f    /* A long file name entry */
00217 #define FATFS_ATTR_ALL          0x3f    /* all flags set */
00218 
00219 /* flags for lowercase field */
00220 #define FATFS_CASE_LOWER_BASE   0x08    /* base is lower case */
00221 #define FATFS_CASE_LOWER_EXT    0x10    /* extension is lower case */
00222 #define FATFS_CASE_LOWER_ALL    0x18    /* both are lower */
00223 
00224 #define FATFS_SEC_MASK          0x1f    /* number of seconds div by 2 */
00225 #define FATFS_SEC_SHIFT         0
00226 #define FATFS_SEC_MIN           0
00227 #define FATFS_SEC_MAX           30
00228 #define FATFS_MIN_MASK          0x7e0   /* number of minutes 0-59 */
00229 #define FATFS_MIN_SHIFT         5
00230 #define FATFS_MIN_MIN           0
00231 #define FATFS_MIN_MAX           59
00232 #define FATFS_HOUR_MASK         0xf800  /* number of hours 0-23 */
00233 #define FATFS_HOUR_SHIFT        11
00234 #define FATFS_HOUR_MIN          0
00235 #define FATFS_HOUR_MAX          23
00236 
00237 /* return 1 if x is a valid FAT time */
00238 #define FATFS_ISTIME(x) \
00239         (((((x & FATFS_SEC_MASK) >> FATFS_SEC_SHIFT) > FATFS_SEC_MAX) || \
00240           (((x & FATFS_MIN_MASK) >> FATFS_MIN_SHIFT) > FATFS_MIN_MAX) || \
00241           (((x & FATFS_HOUR_MASK) >> FATFS_HOUR_SHIFT) > FATFS_HOUR_MAX) ) == 0)
00242 
00243 #define FATFS_DAY_MASK          0x1f    /* day of month 1-31 */
00244 #define FATFS_DAY_SHIFT         0
00245 #define FATFS_DAY_MIN           1
00246 #define FATFS_DAY_MAX           31
00247 #define FATFS_MON_MASK          0x1e0   /* month 1-12 */
00248 #define FATFS_MON_SHIFT         5
00249 #define FATFS_MON_MIN           1
00250 #define FATFS_MON_MAX           12
00251 #define FATFS_YEAR_MASK         0xfe00  /* year, from 1980 0-127 */
00252 #define FATFS_YEAR_SHIFT        9
00253 #define FATFS_YEAR_MIN          0
00254 #define FATFS_YEAR_MAX          127
00255 
00256 /* return 1 if x is a valid FAT date */
00257 #define FATFS_ISDATE(x) \
00258          (((((x & FATFS_DAY_MASK) >> FATFS_DAY_SHIFT) > FATFS_DAY_MAX) || \
00259            (((x & FATFS_DAY_MASK) >> FATFS_DAY_SHIFT) < FATFS_DAY_MIN) || \
00260            (((x & FATFS_MON_MASK) >> FATFS_MON_SHIFT) > FATFS_MON_MAX) || \
00261            (((x & FATFS_MON_MASK) >> FATFS_MON_SHIFT) < FATFS_MON_MIN) || \
00262            (((x & FATFS_YEAR_MASK) >> FATFS_YEAR_SHIFT) > FATFS_YEAR_MAX) ) == 0)
00263 
00264 /* 
00265  * Long file name support for windows 
00266  *
00267  * Contents of this are in UNICODE, not ASCII 
00268  */
00269     typedef struct {
00270         uint8_t seq;
00271         uint8_t part1[10];
00272         uint8_t attributes;
00273         uint8_t reserved1;
00274         uint8_t chksum;
00275         uint8_t part2[12];
00276         uint8_t reserved2[2];
00277         uint8_t part3[4];
00278     } fatfs_dentry_lfn;
00279 
00280 /* flags for seq field */
00281 #define FATFS_LFN_SEQ_FIRST     0x40    /* This bit is set for the first lfn entry */
00282 #define FATFS_LFN_SEQ_MASK      0x3f    /* These bits are a mask for the decreasing
00283                                          * sequence number for the entries */
00284 
00285 /* internal FATFS_INFO structure */
00286     typedef struct {
00287         TSK_FS_INFO fs_info;    /* super class */
00288         //TSK_DATA_BUF *table;      /* cached section of file allocation table */
00289 
00290         /* FAT cache */
00291         char fatc_buf[FAT_CACHE_N][FAT_CACHE_B];
00292         DADDR_T fatc_addr[FAT_CACHE_N];
00293         uint8_t fatc_ttl[FAT_CACHE_N];  // ttl of 0 means is not in use
00294 
00295 
00296         TSK_DATA_BUF *dinodes;  /* sector size buffer of inode list */
00297         fatfs_sb *sb;
00298 
00299         fatfs_dentry *dep;
00300 
00301 
00302         /* FIrst sector of FAT */
00303         DADDR_T firstfatsect;
00304 
00305         /* First sector after FAT  - For TSK_FS_INFO_TYPE_FAT_12 and TSK_FS_INFO_TYPE_FAT_16, this is where the
00306          * root directory entries are.  For TSK_FS_INFO_TYPE_FAT_32, this is the the first 
00307          * cluster */
00308         DADDR_T firstdatasect;
00309 
00310         /* The sector number were cluster 2 (the first one) is
00311          * for TSK_FS_INFO_TYPE_FAT_32, it will be the same as firstdatasect, but for TSK_FS_INFO_TYPE_FAT_12 & 16
00312          * it will be the first sector after the Root directory  */
00313         DADDR_T firstclustsect;
00314 
00315         /* size of data area in clusters, starting at firstdatasect */
00316         DADDR_T clustcnt;
00317 
00318         DADDR_T lastclust;
00319 
00320         /* sector where the root directory is located */
00321         DADDR_T rootsect;
00322 
00323         uint32_t dentry_cnt_se; /* max number of dentries per sector */
00324         uint32_t dentry_cnt_cl; /* max number of dentries per cluster */
00325 
00326         uint16_t ssize;         /* size of sectors in bytes */
00327         uint16_t ssize_sh;      /* power of 2 for size of sectors */
00328         uint8_t csize;          /* size of clusters in sectors */
00329         //uint16_t      reserved;       /* number of reserved sectors */
00330         uint8_t numfat;         /* number of fat tables */
00331         uint32_t sectperfat;    /* sectors per fat table */
00332         uint16_t numroot;       /* number of 32-byte dentries in root dir */
00333         uint32_t mask;          /* the mask to use for the sectors */
00334     } FATFS_INFO;
00335 
00336 
00337     extern int8_t is_sectalloc(FATFS_INFO *, DADDR_T);
00338 
00339     extern uint8_t fatfs_dent_walk(TSK_FS_INFO *, INUM_T,
00340         TSK_FS_DENT_FLAG_ENUM, TSK_FS_DENT_TYPE_WALK_CB, void *);
00341     extern uint8_t fatfs_isdentry(FATFS_INFO *, fatfs_dentry *);
00342     extern uint8_t fatfs_make_root(FATFS_INFO *, TSK_FS_INODE *);
00343     extern TSK_RETVAL_ENUM fatfs_dinode_copy(FATFS_INFO *, TSK_FS_INODE *,
00344         fatfs_dentry *, DADDR_T, INUM_T);
00345 
00346 #ifdef __cplusplus
00347 }
00348 #endif
00349 #endif

Generated on Wed Nov 28 16:11:14 2007 for The Sleuth Kit (Incomplete) by  doxygen 1.5.1