fs_tools.h

Go to the documentation of this file.
00001 /*
00002 ** fs_tools
00003 ** The Sleuth Kit 
00004 **
00005 ** This header file is to be included if file system routines
00006 ** are used from the library.  
00007 **
00008 ** $Date: 2007/11/29 02:21:41 $
00009 **
00010 ** Brian Carrier [carrier@sleuthkit.org]
00011 ** Copyright (c) 2003-2007 Brian Carrier.  All rights reserved
00012 **
00013 ** TASK
00014 ** Copyright (c) 2002 @stake Inc.  All rights reserved
00015 ** 
00016 ** Copyright (c) 1997,1998,1999, International Business Machines          
00017 ** Corporation and others. All Rights Reserved.
00018 */
00019 
00027 #ifndef _TSK_FS_TOOLS_H
00028 #define _TSK_FS_TOOLS_H
00029 
00030 #include "img_tools.h"
00031 #include <sys/types.h>
00032 
00033 
00034 
00035 #ifdef __cplusplus
00036 extern "C" {
00037 #endif
00038 
00039 /****************  FILE SYSTEM TYPES SECTION ********************/
00040 
00046     enum TSK_FS_INFO_TYPE_ENUM {
00047         TSK_FS_INFO_TYPE_FS_MASK = 0xf0,        
00048         TSK_FS_INFO_TYPE_SUB_MASK = 0x0f,       
00049 
00050         TSK_FS_INFO_TYPE_UNSUPP = 0x00, 
00051 
00052         TSK_FS_INFO_TYPE_FFS_TYPE = 0x10,       
00053         TSK_FS_INFO_TYPE_FFS_1 = 0x11,  
00054         TSK_FS_INFO_TYPE_FFS_1B = 0x12, 
00055         TSK_FS_INFO_TYPE_FFS_2 = 0x13,  
00056         TSK_FS_INFO_TYPE_FFS_AUTO = 0x14,       
00057 
00058         TSK_FS_INFO_TYPE_EXT_TYPE = 0x20,       
00059         TSK_FS_INFO_TYPE_EXT_2 = 0x21,  
00060         TSK_FS_INFO_TYPE_EXT_3 = 0x22,  
00061         TSK_FS_INFO_TYPE_EXT_AUTO = 0x23,       
00062 
00063         TSK_FS_INFO_TYPE_FAT_TYPE = 0x30,       
00064         TSK_FS_INFO_TYPE_FAT_12 = 0x31, 
00065         TSK_FS_INFO_TYPE_FAT_16 = 0x32, 
00066         TSK_FS_INFO_TYPE_FAT_32 = 0x33, 
00067         TSK_FS_INFO_TYPE_FAT_AUTO = 0x34,       
00068 
00069         TSK_FS_INFO_TYPE_NTFS_TYPE = 0x40,      
00070         TSK_FS_INFO_TYPE_NTFS = 0x40,   
00071         TSK_FS_INFO_TYPE_NTFS_AUTO = 0x40,      
00072 
00073         TSK_FS_INFO_TYPE_SWAP_TYPE = 0x50,      
00074         TSK_FS_INFO_TYPE_SWAP = 0x50,   
00075 
00076         TSK_FS_INFO_TYPE_RAW_TYPE = 0x60,       
00077         TSK_FS_INFO_TYPE_RAW = 0x60,    
00078 
00079         TSK_FS_INFO_TYPE_ISO9660_TYPE = 0x70,   
00080         TSK_FS_INFO_TYPE_ISO9660 = 0x70,        
00081 
00082         TSK_FS_INFO_TYPE_HFS_TYPE = 0x80,       
00083         TSK_FS_INFO_TYPE_HFS = 0x80,    
00084     };
00085     typedef enum TSK_FS_INFO_TYPE_ENUM TSK_FS_INFO_TYPE_ENUM;
00086 
00087     extern TSK_FS_INFO_TYPE_ENUM tsk_fs_parse_type(const TSK_TCHAR *);
00088     extern void tsk_fs_print_types(FILE *);
00089     extern char *tsk_fs_get_type(TSK_FS_INFO_TYPE_ENUM);
00090 
00091     typedef struct TSK_FS_INFO TSK_FS_INFO;
00092     typedef struct TSK_FS_DATA TSK_FS_DATA;
00093     typedef struct TSK_FS_DATA_RUN TSK_FS_DATA_RUN;
00094     typedef struct TSK_FS_INODE_NAME_LIST TSK_FS_INODE_NAME_LIST;
00095     typedef struct TSK_FS_JENTRY TSK_FS_JENTRY;
00096 
00097 
00098 
00099 
00100 /************************************************************************* 
00101  * Directory entries 
00102  */
00103 
00108     enum TSK_FS_DENT_FLAG_ENUM {
00109         TSK_FS_DENT_FLAG_ALLOC = (1 << 0),      
00110         TSK_FS_DENT_FLAG_UNALLOC = (1 << 1),    
00111         TSK_FS_DENT_FLAG_RECURSE = (1 << 2),    
00112     };
00113     typedef enum TSK_FS_DENT_FLAG_ENUM TSK_FS_DENT_FLAG_ENUM;
00114 
00115 
00119     enum TSK_FS_DENT_TYPE_ENUM {
00120         TSK_FS_DENT_TYPE_UNDEF = 0,     
00121         TSK_FS_DENT_TYPE_FIFO = 1,      
00122         TSK_FS_DENT_TYPE_CHR = 2,       
00123         TSK_FS_DENT_TYPE_DIR = 4,       
00124         TSK_FS_DENT_TYPE_BLK = 6,       
00125         TSK_FS_DENT_TYPE_REG = 8,       
00126         TSK_FS_DENT_TYPE_LNK = 10,      
00127         TSK_FS_DENT_TYPE_SOCK = 12,     
00128         TSK_FS_DENT_TYPE_SHAD = 13,     
00129         TSK_FS_DENT_TYPE_WHT = 14,      
00130     };
00131     typedef enum TSK_FS_DENT_TYPE_ENUM TSK_FS_DENT_TYPE_ENUM;
00132 
00133 #define TSK_FS_DENT_TYPE_MAX_STR 15     
00134 
00135 /* ascii representation of above types */
00136     extern char tsk_fs_dent_str[TSK_FS_DENT_TYPE_MAX_STR][2];
00137 
00144     struct TSK_FS_DENT {
00145         char *name;             
00146         ULONG name_max;         
00147 
00148         char *shrt_name;        
00149         ULONG shrt_name_max;    
00150 
00151         char *path;             
00152         unsigned int pathdepth; 
00153 
00154         INUM_T inode;           
00155         struct TSK_FS_INODE *fsi;       
00156 
00157         TSK_FS_DENT_TYPE_ENUM ent_type; 
00158         TSK_FS_DENT_FLAG_ENUM flags;    
00159     };
00160 
00161     typedef struct TSK_FS_DENT TSK_FS_DENT;
00162 
00163 
00164 /******************* INODE / META DATA **************/
00165 
00166 
00170     enum TSK_FS_INODE_FLAG_ENUM {
00171         TSK_FS_INODE_FLAG_ALLOC = (1 << 0),     
00172         TSK_FS_INODE_FLAG_UNALLOC = (1 << 1),   
00173         TSK_FS_INODE_FLAG_USED = (1 << 2),      
00174         TSK_FS_INODE_FLAG_UNUSED = (1 << 3),    
00175         TSK_FS_INODE_FLAG_ORPHAN = (1 << 4),    
00176         TSK_FS_INODE_FLAG_COMP = (1 << 5)       
00177     };
00178     typedef enum TSK_FS_INODE_FLAG_ENUM TSK_FS_INODE_FLAG_ENUM;
00179 
00180     enum TSK_FS_INODE_ATTR_FLAG_ENUM {
00181         TSK_FS_INODE_ATTR_EMPTY,        
00182         TSK_FS_INODE_ATTR_STUDIED,      
00183         TSK_FS_INODE_ATTR_ERROR 
00184     };
00185     typedef enum TSK_FS_INODE_ATTR_FLAG_ENUM TSK_FS_INODE_ATTR_FLAG_ENUM;
00186 
00187 
00191 #define TSK_FS_INODE_NAME_LIST_NSIZE    512
00192 
00200     struct TSK_FS_INODE_NAME_LIST {
00201         TSK_FS_INODE_NAME_LIST *next;   
00202         char name[TSK_FS_INODE_NAME_LIST_NSIZE];        
00203         INUM_T par_inode;       
00204         uint32_t par_seq;       
00205     };
00206 
00210     struct TSK_FS_INODE {
00211         INUM_T addr;            
00212         mode_t mode;            
00213         int nlink;              
00214         OFF_T size;             
00215         uid_t uid;              
00216         gid_t gid;              
00217 
00218         /* @@@ Need to make these 64-bits ... ? */
00219         time_t mtime;           
00220         time_t atime;           
00221         time_t ctime;           
00222 
00223         /* filesystem specific times */
00224         union {
00225             struct {
00226                 time_t crtime;  
00227             };
00228             struct {
00229                 time_t dtime;   
00230             };
00231             struct {
00232                 time_t bkup_time;       
00233                 time_t attr_mtime;      
00234             };
00235         };
00236 
00237         DADDR_T *direct_addr;   
00238         int direct_count;       
00239         DADDR_T *indir_addr;    
00240         int indir_count;        
00241 
00242         uint32_t seq;           
00243 
00244         TSK_FS_DATA *attr;      
00245         TSK_FS_INODE_ATTR_FLAG_ENUM attr_state; 
00246         uint8_t attr_flags;     
00247 
00248         TSK_FS_INODE_NAME_LIST *name;   
00249         char *link;             
00250 
00251         TSK_FS_INODE_FLAG_ENUM flags;   
00252     };
00253 
00254     typedef struct TSK_FS_INODE TSK_FS_INODE;
00255 
00256     extern TSK_FS_INODE *tsk_fs_inode_alloc(int, int);
00257     extern TSK_FS_INODE *tsk_fs_inode_realloc(TSK_FS_INODE *, int, int);
00258     extern void tsk_fs_inode_free(TSK_FS_INODE *);
00259 
00260 
00263 #define TSK_FS_ORPHAN_STR "-ORPHAN_FILE-"
00264 
00265 /* Type of file in the mode field of Inodes.  FAT and NTFS are converted
00266  * to this mode value */
00267 
00272     enum TSK_FS_INODE_MODE_ENUM {
00273 
00274         /* the following are file types */
00275         TSK_FS_INODE_MODE_FMT = 0170000,        
00276         TSK_FS_INODE_MODE_FIFO = 0010000,       
00277         TSK_FS_INODE_MODE_CHR = 0020000,        
00278         TSK_FS_INODE_MODE_DIR = 0040000,        
00279         TSK_FS_INODE_MODE_BLK = 0060000,        
00280         TSK_FS_INODE_MODE_REG = 0100000,        
00281         TSK_FS_INODE_MODE_LNK = 0120000,        
00282         TSK_FS_INODE_MODE_SHAD = 0130000,       
00283         TSK_FS_INODE_MODE_SOCK = 0140000,       
00284         TSK_FS_INODE_MODE_WHT = 0160000,        
00285 
00286         /* The following describe the file permissions */
00287         TSK_FS_INODE_MODE_ISUID = 0004000,      
00288         TSK_FS_INODE_MODE_ISGID = 0002000,      
00289         TSK_FS_INODE_MODE_ISVTX = 0001000,      
00290 
00291         TSK_FS_INODE_MODE_IRUSR = 0000400,      
00292         TSK_FS_INODE_MODE_IWUSR = 0000200,      
00293         TSK_FS_INODE_MODE_IXUSR = 0000100,      
00294 
00295         TSK_FS_INODE_MODE_IRGRP = 0000040,      
00296         TSK_FS_INODE_MODE_IWGRP = 0000020,      
00297         TSK_FS_INODE_MODE_IXGRP = 0000010,      
00298 
00299         TSK_FS_INODE_MODE_IROTH = 0000004,      
00300         TSK_FS_INODE_MODE_IWOTH = 0000002,      
00301         TSK_FS_INODE_MODE_IXOTH = 0000001       
00302     };
00303     typedef enum TSK_FS_INODE_MODE_ENUM TSK_FS_INODE_MODE_ENUM;
00304 
00305 
00306 #define TSK_FS_INODE_MODE_TYPE_SHIFT    12      
00307 #define TSK_FS_INODE_MODE_TYPE_STR_MAX 15       
00308 
00309     extern char tsk_fs_inode_mode_str[TSK_FS_INODE_MODE_TYPE_STR_MAX][2];
00310 
00311 
00314     enum TSK_FS_BLOCK_FLAG_ENUM {
00315         TSK_FS_BLOCK_FLAG_ALLOC = (1 << 0),     
00316         TSK_FS_BLOCK_FLAG_UNALLOC = (1 << 1),   
00317         TSK_FS_BLOCK_FLAG_CONT = (1 << 2),      
00318         TSK_FS_BLOCK_FLAG_META = (1 << 3),      
00319         TSK_FS_BLOCK_FLAG_BAD = (1 << 4),       
00320         TSK_FS_BLOCK_FLAG_ALIGN = (1 << 5),     
00321         TSK_FS_BLOCK_FLAG_RES = (1 << 6),       
00322         TSK_FS_BLOCK_FLAG_SPARSE = (1 << 7),    
00323         TSK_FS_BLOCK_FLAG_COMP = (1 << 8)       
00324     };
00325     typedef enum TSK_FS_BLOCK_FLAG_ENUM TSK_FS_BLOCK_FLAG_ENUM;
00326 
00327 
00328 
00332     enum TSK_FS_FILE_FLAG_ENUM {
00333         TSK_FS_FILE_FLAG_AONLY = (1 << 0),      
00334         TSK_FS_FILE_FLAG_SLACK = (1 << 1),      
00335         TSK_FS_FILE_FLAG_RECOVER = (1 << 2),    
00336         TSK_FS_FILE_FLAG_META = (1 << 3),       
00337         TSK_FS_FILE_FLAG_NOSPARSE = (1 << 4),   
00338         TSK_FS_FILE_FLAG_NOID = (1 << 5)        
00339     };
00340     typedef enum TSK_FS_FILE_FLAG_ENUM TSK_FS_FILE_FLAG_ENUM;
00341 
00342 /* walk callback functions */
00343     typedef uint8_t(*TSK_FS_INODE_WALK_CB) (TSK_FS_INFO *, TSK_FS_INODE *,
00344         void *);
00345     typedef uint8_t(*TSK_FS_BLOCK_WALK_CB) (TSK_FS_INFO *, DADDR_T, char *,
00346         TSK_FS_BLOCK_FLAG_ENUM, void *);
00347     typedef uint8_t(*TSK_FS_DENT_TYPE_WALK_CB) (TSK_FS_INFO *,
00348         TSK_FS_DENT *, void *);
00349     typedef uint8_t(*TSK_FS_FILE_WALK_CB) (TSK_FS_INFO *, DADDR_T, char *,
00350         size_t, TSK_FS_BLOCK_FLAG_ENUM, void *);
00351     typedef uint8_t(*TSK_FS_JBLK_WALK_CB) (TSK_FS_INFO *, char *, int,
00352         void *);
00353     typedef uint8_t(*TSK_FS_JENTRY_WALK_CB) (TSK_FS_INFO *,
00354         TSK_FS_JENTRY *, int, void *);
00355 
00356 
00357 /******************************* TSK_FS_INFO ******************/
00358 
00362     enum TSK_FS_INFO_FLAG_ENUM {
00363         TSK_FS_INFO_FLAG_HAVE_SEQ = (1 << 0)    
00364     };
00365     typedef enum TSK_FS_INFO_FLAG_ENUM TSK_FS_INFO_FLAG_ENUM;
00366 
00367 
00374     struct TSK_FS_INFO {
00375         TSK_IMG_INFO *img_info; 
00376         SSIZE_T offset;         
00377 
00378         /* meta data */
00379         INUM_T inum_count;      
00380         INUM_T root_inum;       
00381         INUM_T first_inum;      
00382         INUM_T last_inum;       
00383 
00384         /* content */
00385         DADDR_T block_count;    
00386         DADDR_T first_block;    
00387         DADDR_T last_block;     
00388         DADDR_T last_block_act; 
00389         unsigned int block_size;        
00390         unsigned int dev_bsize; 
00391 
00392         /* Journal */
00393         INUM_T journ_inum;      
00394 
00395         TSK_FS_INFO_TYPE_ENUM ftype;    
00396         char *duname;           
00397         TSK_FS_INFO_FLAG_ENUM flags;    
00398 
00399         uint8_t endian;         
00400 
00401         TSK_LIST *list_inum_named;      
00415          uint8_t(*block_walk) (TSK_FS_INFO * fs, DADDR_T start,
00416             DADDR_T end, TSK_FS_BLOCK_FLAG_ENUM flags,
00417             TSK_FS_BLOCK_WALK_CB cb, void *ptr);
00418 
00428          uint8_t(*inode_walk) (TSK_FS_INFO * fs, INUM_T start, INUM_T end,
00429             TSK_FS_INODE_FLAG_ENUM flags, TSK_FS_INODE_WALK_CB cb,
00430             void *ptr);
00431 
00437         TSK_FS_INODE *(*inode_lookup) (TSK_FS_INFO * fs, INUM_T addr);
00438 
00450          uint8_t(*istat) (TSK_FS_INFO * fs, FILE * hFile, INUM_T inum,
00451             DADDR_T numblock, int32_t sec_skew);
00452 
00465          uint8_t(*file_walk) (TSK_FS_INFO * fs, TSK_FS_INODE * fs_inode,
00466             uint32_t type, uint16_t id, TSK_FS_FILE_FLAG_ENUM flags,
00467             TSK_FS_FILE_WALK_CB cb, void *ptr);
00468 
00469 
00480          uint8_t(*dent_walk) (TSK_FS_INFO * fs, INUM_T inode,
00481             TSK_FS_DENT_FLAG_ENUM flags, TSK_FS_DENT_TYPE_WALK_CB action,
00482             void *ptr);
00483 
00485          uint8_t(*jopen) (TSK_FS_INFO *, INUM_T);
00486 
00488          uint8_t(*jblk_walk) (TSK_FS_INFO *, DADDR_T, DADDR_T, int,
00489             TSK_FS_JBLK_WALK_CB, void *);
00490 
00492          uint8_t(*jentry_walk) (TSK_FS_INFO *, int, TSK_FS_JENTRY_WALK_CB,
00493             void *);
00494 
00503          uint8_t(*fsstat) (TSK_FS_INFO * fs, FILE * hFile);
00504 
00506          uint8_t(*fscheck) (TSK_FS_INFO *, FILE *);
00507 
00512         void (*close) (TSK_FS_INFO * fs);
00513     };
00514 
00515 
00516 
00517 /***************************************************************
00518  * Generic inode structure for filesystem-independent operations.
00519  */
00520 
00521 
00522 /* 
00523  * All non-resident addresses will be stored here so that the search
00524  * programs (find_inode) can account for the addresses. 
00525  *
00526  * All resident non-standard attributes will be stored here so they
00527  * can be displayed.  By default, the $Data attribute will be saved
00528  * in the TSK_FS_INODE structure. If the $Data attribute is resident,
00529  * then the dir/indir stuff will be 0 and the $Data will be the
00530  * first element in this linked list 
00531  */
00532 
00536     enum TSK_FS_DATA_RUN_FLAG_ENUM {
00537         TSK_FS_DATA_RUN_FLAG_FILLER = 0x1,      
00538         TSK_FS_DATA_RUN_FLAG_SPARSE = 0x2       
00539     };
00540     typedef enum TSK_FS_DATA_RUN_FLAG_ENUM TSK_FS_DATA_RUN_FLAG_ENUM;
00541 
00542 /* len = 0 when not being used */
00547     struct TSK_FS_DATA_RUN {
00548         TSK_FS_DATA_RUN *next;  
00549         DADDR_T offset;         
00550         DADDR_T addr;           
00551         DADDR_T len;            
00552         TSK_FS_DATA_RUN_FLAG_ENUM flags;        
00553     };
00554 
00555 
00559     enum TSK_FS_DATA_FLAG_ENUM {
00560         TSK_FS_DATA_INUSE = 0x1,        
00561         TSK_FS_DATA_NONRES = 0x2,       
00562         TSK_FS_DATA_RES = 0x4,  
00563         TSK_FS_DATA_ENC = 0x10, 
00564         TSK_FS_DATA_COMP = 0x20,        
00565         TSK_FS_DATA_SPARSE = 0x40,      
00566         TSK_FS_DATA_RECOVERY = 0x80,    
00567     };
00568     typedef enum TSK_FS_DATA_FLAG_ENUM TSK_FS_DATA_FLAG_ENUM;
00569 
00578     struct TSK_FS_DATA {
00579         TSK_FS_DATA *next;      
00580         TSK_FS_DATA_FLAG_ENUM flags;    
00581         char *name;             
00582         size_t nsize;           
00583         uint32_t type;          
00584         uint16_t id;            
00585 
00586         OFF_T size;             
00587 
00588         /* Run-List data (non-resident) */
00589         TSK_FS_DATA_RUN *run;   
00590         TSK_FS_DATA_RUN *run_end;       
00591         OFF_T allocsize;        
00592         uint32_t compsize;      
00593 
00594         /* stream data (resident) */
00595         size_t buflen;          
00596         uint8_t *buf;           
00597     };
00598 
00599 
00600 
00601     extern TSK_FS_DATA *tsk_fs_data_alloc(TSK_FS_DATA_FLAG_ENUM);
00602     extern TSK_FS_DATA_RUN *tsk_fs_data_run_alloc();
00603     extern TSK_FS_DATA *tsk_fs_data_getnew_attr(TSK_FS_DATA *,
00604         TSK_FS_DATA_FLAG_ENUM);
00605     extern void tsk_fs_data_clear_list(TSK_FS_DATA *);
00606 
00607     extern TSK_FS_DATA *tsk_fs_data_put_str(TSK_FS_DATA *, char *,
00608         uint32_t, uint16_t, void *, unsigned int);
00609 
00610     extern TSK_FS_DATA *tsk_fs_data_put_run(TSK_FS_DATA *, OFF_T,
00611         TSK_FS_DATA_RUN *, char *, uint32_t, uint16_t, OFF_T,
00612         TSK_FS_DATA_FLAG_ENUM, uint32_t);
00613 
00614     extern TSK_FS_DATA *tsk_fs_data_lookup(TSK_FS_DATA *, uint32_t,
00615         uint16_t);
00616     extern TSK_FS_DATA *tsk_fs_data_lookup_noid(TSK_FS_DATA *, uint32_t);
00617 
00618     extern void tsk_fs_data_run_free(TSK_FS_DATA_RUN *);
00619     extern void tsk_fs_data_free(TSK_FS_DATA *);
00620 
00621 
00622 
00623 /**************** Journal Stuff **********************/
00624     struct TSK_FS_JENTRY {
00625         DADDR_T jblk;           /* journal block address */
00626         DADDR_T fsblk;          /* fs block that journal entry is about */
00627     };
00628 
00629 
00630 
00631 /* function decs */
00632     extern TSK_FS_DENT *tsk_fs_dent_alloc(ULONG, ULONG);
00633     extern TSK_FS_DENT *tsk_fs_dent_realloc(TSK_FS_DENT *, ULONG);
00634     extern void tsk_fs_dent_free(TSK_FS_DENT *);
00635     extern void tsk_fs_dent_print(FILE *, TSK_FS_DENT *,
00636         TSK_FS_INFO *, TSK_FS_DATA *);
00637     extern void tsk_fs_dent_print_long(FILE *, TSK_FS_DENT *,
00638         TSK_FS_INFO *, TSK_FS_DATA *);
00639     extern void tsk_fs_dent_print_mac(FILE *, TSK_FS_DENT *,
00640         TSK_FS_INFO *, TSK_FS_DATA * fs_data, char *);
00641 
00642     extern void tsk_fs_make_ls(mode_t, char *);
00643     extern void tsk_fs_print_day(FILE *, time_t);
00644     extern void tsk_fs_print_time(FILE *, time_t);
00645 
00646 /*
00647 ** Is this string a "." or ".."
00648 */
00649 #define TSK_FS_ISDOT(str) ( ((str[0] == '.') && \
00650  ( ((str[1] == '.') && (str[2] == '\0')) || (str[1] == '\0') ) ) ? 1 : 0 )
00651 
00652 
00653 
00654 /**************************************************************8
00655  * Generic routines.
00656  */
00657     extern TSK_FS_INFO *tsk_fs_open(TSK_IMG_INFO *, SSIZE_T,
00658         const TSK_TCHAR *);
00659 
00660 /* fs_io routines */
00661     extern SSIZE_T tsk_fs_read_block(TSK_FS_INFO *, TSK_DATA_BUF *, OFF_T,
00662         DADDR_T);
00663     extern SSIZE_T tsk_fs_read_block_nobuf(TSK_FS_INFO *, char *, OFF_T,
00664         DADDR_T);
00665 #define tsk_fs_read_random(fsi, buf, len, offs) \
00666         (fsi)->img_info->read_random((fsi)->img_info, (fsi)->offset, (buf), (len), (offs))
00667 
00668     extern char *tsk_fs_load_file(TSK_FS_INFO *, TSK_FS_INODE *, uint32_t,
00669         uint16_t, int);
00670 
00671     extern SSIZE_T
00672         tsk_fs_read_file(TSK_FS_INFO *, TSK_FS_INODE *, uint32_t, uint16_t,
00673         SSIZE_T, SSIZE_T, char *);
00674 
00675     extern SSIZE_T
00676         tsk_fs_read_file_noid(TSK_FS_INFO *, TSK_FS_INODE *, SSIZE_T,
00677         SSIZE_T, char *);
00678 
00679 
00680 
00681 /***** LIBRARY ROUTINES FOR COMMAND LINE FUNCTIONS */
00682 #define TSK_FS_DCALC_DD        0x1
00683 #define TSK_FS_DCALC_DLS       0x2
00684 #define TSK_FS_DCALC_SLACK     0x4
00685     extern int8_t tsk_fs_dcalc(TSK_FS_INFO * fs, uint8_t lclflags,
00686         DADDR_T cnt);
00687 
00688 
00689 #define TSK_FS_DCAT_HEX                0x1
00690 #define TSK_FS_DCAT_ASCII   0x2
00691 #define TSK_FS_DCAT_HTML       0x4
00692 #define TSK_FS_DCAT_STAT       0x8
00693     extern uint8_t tsk_fs_dcat(TSK_FS_INFO * fs, uint8_t lclflags,
00694         DADDR_T addr, DADDR_T read_num_units);
00695 
00696 
00697 #define TSK_FS_DLS_CAT     0x01
00698 #define TSK_FS_DLS_LIST    0x02
00699 #define TSK_FS_DLS_SLACK   0x04
00700     extern uint8_t tsk_fs_dls(TSK_FS_INFO * fs, uint8_t lclflags,
00701         DADDR_T bstart, DADDR_T bend, TSK_FS_BLOCK_FLAG_ENUM flags);
00702 
00703     extern uint8_t tsk_fs_dstat(TSK_FS_INFO * fs, uint8_t lclflags,
00704         DADDR_T addr, TSK_FS_BLOCK_FLAG_ENUM flags);
00705 
00706 #define TSK_FS_FFIND_ALL 0x1
00707     extern uint8_t tsk_fs_ffind(TSK_FS_INFO * fs, uint8_t lclflags,
00708         INUM_T inode, uint32_t type, uint16_t id, int flags);
00709 
00710 
00711 
00712 #define TSK_FS_FLS_DOT         0x001
00713 #define TSK_FS_FLS_LONG        0x002
00714 #define TSK_FS_FLS_FILE        0x004
00715 #define TSK_FS_FLS_DIR         0x008
00716 #define TSK_FS_FLS_FULL        0x010
00717 #define TSK_FS_FLS_MAC         0x020
00718     extern uint8_t tsk_fs_fls(TSK_FS_INFO * fs, uint8_t lclflags,
00719         INUM_T inode, int flags, TSK_TCHAR * pre, int32_t skew);
00720 
00721 
00722     extern uint8_t tsk_fs_icat(TSK_FS_INFO * fs, uint8_t lclflags,
00723         INUM_T inum, uint32_t type, uint16_t id, int flags);
00724 
00725 
00726 #define TSK_FS_IFIND_ALL       0x01
00727 #define TSK_FS_IFIND_PATH      0x04
00728 #define TSK_FS_IFIND_DATA      0x08
00729 #define TSK_FS_IFIND_PAR       0x10
00730 #define TSK_FS_IFIND_PAR_LONG  0x20
00731     extern int8_t tsk_fs_ifind_path(TSK_FS_INFO * fs, uint8_t lclflags,
00732         TSK_TCHAR * path, INUM_T * result);
00733     extern uint8_t tsk_fs_ifind_data(TSK_FS_INFO * fs, uint8_t lclflags,
00734         DADDR_T blk);
00735     extern uint8_t tsk_fs_ifind_par(TSK_FS_INFO * fs, uint8_t lclflags,
00736         INUM_T par);
00737 
00738 
00739 #define TSK_FS_ILS_OPEN        (1<<0)
00740 #define TSK_FS_ILS_MAC          (1<<1)
00741 #define TSK_FS_ILS_LINK (1<<2)
00742 #define TSK_FS_ILS_UNLINK       (1<<3)
00743 
00744     extern uint8_t tsk_fs_ils(TSK_FS_INFO * fs, uint8_t lclflags,
00745         INUM_T istart, INUM_T ilast, int flags, int32_t skew,
00746         TSK_TCHAR * img);
00747 
00748 
00749 
00750     extern uint8_t
00751         fatfs_file_walk_off(TSK_FS_INFO * fs, TSK_FS_INODE * fs_inode,
00752         uint32_t type, uint16_t id, OFF_T a_st_off,
00753         TSK_FS_FILE_FLAG_ENUM flags, TSK_FS_FILE_WALK_CB action,
00754         void *ptr);
00755 
00756 
00757 #ifdef __cplusplus
00758 }
00759 #endif
00760 #endif
00761 /* LICENSE
00762  * .ad
00763  * .fi
00764  *      This software is distributed under the IBM Public License.
00765  * AUTHOR(S)
00766  *      Wietse Venema
00767  *      IBM T.J. Watson Research
00768  *      P.O. Box 704
00769  *      Yorktown Heights, NY 10598, USA
00770  --*/

Generated on Wed Nov 28 16:11:15 2007 for The Sleuth Kit (Incomplete) by  doxygen 1.5.1