TSK_FS_DATA Struct Reference

#include <fs_tools.h>


Detailed Description

Generic structure to hold attributes for files.

Attributes are a general term to describe any group of "data" -- it could be file contents or meta data. This structures are used currently only for NTFS because it has "multiple attributes", but it could be used for other FS in the future. These are grouped into an unsorted linked list.


Data Fields

TSK_FS_DATAnext
 Pointer to next attribute in list.
TSK_FS_DATA_FLAG_ENUM flags
 Flags for attribute.
char * name
 Attribute name (could be NULL) (in UTF-8).
size_t nsize
 Number of bytes allocated to name.
uint32_t type
 Type of attribute.
uint16_t id
 Id of attribute.
OFF_T size
 Size in bytes of attribute.
TSK_FS_DATA_RUNrun
 Linked list of runs for non-resident attributes.
TSK_FS_DATA_RUNrun_end
 Pointer to final run in the list.
OFF_T allocsize
 Number of bytes that are allocated in all clusters of non-resident run (will be larger than size).
uint32_t compsize
 Size of compression units (needed only if file is compressed).
size_t buflen
 Number of bytes allocated to resident buffer.
uint8_t * buf
 Buffer for resident data.


The documentation for this struct was generated from the following file:
Generated on Wed Nov 28 16:11:18 2007 for The Sleuth Kit (Incomplete) by  doxygen 1.5.1