#include "hashdb_tools.h"
Go to the source code of this file.
Defines | |
#define | TSK_HDB_MAXLEN 512 |
Default buffer size used in many places. | |
#define | TSK_HDB_OFF_LEN 16 |
Number of digits used in offset field in index. | |
#define | TSK_HDB_IDX_LEN(x) ( TSK_HDB_HTYPE_LEN(x) + TSK_HDB_OFF_LEN + 2) |
Get the length of an index file line - 2 for comma and newline. | |
#define | TSK_HDB_IDX_HEAD_STR "00000000000000000000000000000000000000000" |
String used in index header. | |
Functions | |
uint8_t | tsk_hdb_idxinitialize (TSK_HDB_INFO *, TSK_TCHAR *dbname) |
Initialize the TSK hash DB index file. | |
uint8_t | tsk_hdb_idxaddentry (TSK_HDB_INFO *, char *hvalue, OFF_T offset) |
Add an entry to the intermediate index file. | |
uint8_t | tsk_hdb_idxfinalize (TSK_HDB_INFO *) |
Finalize index creation process by sorting the index and removing the intermediate temp file. | |
uint8_t | nsrl_test (FILE *) |
Test the file to see if it is an NSRL database. | |
uint8_t | nsrl_makeindex (TSK_HDB_INFO *, TSK_TCHAR *htype) |
Process the database to create a sorted index of it. | |
uint8_t | nsrl_getentry (TSK_HDB_INFO *, char *, OFF_T, TSK_HDB_FLAG_ENUM, TSK_HDB_LOOKUP_FN, void *) |
Find the corresponding name at a given offset. | |
uint8_t | md5sum_test (FILE *) |
Test the file to see if it is a md5sum database. | |
uint8_t | md5sum_makeindex (TSK_HDB_INFO *, TSK_TCHAR *htype) |
Process the database to create a sorted index of it. | |
uint8_t | md5sum_getentry (TSK_HDB_INFO *, char *, OFF_T, TSK_HDB_FLAG_ENUM, TSK_HDB_LOOKUP_FN, void *) |
Find the corresponding name at a given offset. | |
uint8_t | hk_test (FILE *) |
Test the file to see if it is a hashkeeper database. | |
uint8_t | hk_makeindex (TSK_HDB_INFO *, TSK_TCHAR *htype) |
Process the database to create a sorted index of it. | |
uint8_t | hk_getentry (TSK_HDB_INFO *, char *, OFF_T, TSK_HDB_FLAG_ENUM, TSK_HDB_LOOKUP_FN, void *) |
Find the corresponding name at the given offset. | |
uint8_t | idxonly_makeindex (TSK_HDB_INFO *, TSK_TCHAR *htype) |
This function should process the database to create a sorted index of it, but in this case we do not have a database, so just make an error. | |
uint8_t | idxonly_getentry (TSK_HDB_INFO *, char *, OFF_T, TSK_HDB_FLAG_ENUM, TSK_HDB_LOOKUP_FN, void *) |
This function should find the corresponding name at a given offset. |
#define TSK_HDB_IDX_HEAD_STR "00000000000000000000000000000000000000000" |
String used in index header.
It is one longer than a sha-1 hash - so that it always sorts to the top
uint8_t hk_getentry | ( | TSK_HDB_INFO * | hdb_info, | |
char * | hash, | |||
OFF_T | offset, | |||
TSK_HDB_FLAG_ENUM | flags, | |||
TSK_HDB_LOOKUP_FN | action, | |||
void * | cb_ptr | |||
) |
Find the corresponding name at the given offset.
The offset was likely determined from the index. The entries in the DB following the one specified are also processed if they have the same hash value and their name is different. The callback is called for each entry.
hdb_info | Data base to get data from. | |
hash | MD5 hash value that was searched for | |
offset | Byte offset where hash value should be located in db_file | |
flags | ||
action | Callback used for each entry found in lookup | |
cb_ptr | Pointer to data passed to callback |
uint8_t hk_makeindex | ( | TSK_HDB_INFO * | hdb_info, | |
TSK_TCHAR * | dbtype | |||
) |
Process the database to create a sorted index of it.
Consecutive entries with the same hash value are not added to the index, but will be found during lookup.
hdb_info | Hash database to make index of | |
dbtype | Text of type of database (should always be TSK_HDB_DBTYPE_HK_STR) |
uint8_t hk_test | ( | FILE * | hFile | ) |
Test the file to see if it is a hashkeeper database.
hFile | File handle to hash database |
uint8_t idxonly_getentry | ( | TSK_HDB_INFO * | hdb_info, | |
char * | hash, | |||
OFF_T | offset, | |||
TSK_HDB_FLAG_ENUM | flags, | |||
TSK_HDB_LOOKUP_FN | action, | |||
void * | cb_ptr | |||
) |
This function should find the corresponding name at a given offset.
In this case though, we do not have the original database, so just make an error...
hdb_info | Hash database to get data from | |
hash | MD5 hash value that was searched for | |
offset | Byte offset where hash value should be located in db_file | |
flags | (not used) | |
action | Callback used for each entry found in lookup | |
cb_ptr | Pointer to data passed to callback |
uint8_t idxonly_makeindex | ( | TSK_HDB_INFO * | hdb_info, | |
TSK_TCHAR * | dbtype | |||
) |
This function should process the database to create a sorted index of it, but in this case we do not have a database, so just make an error.
..
hdb_info | Hash database to make index of. | |
dbtype | Type of hash database |
uint8_t md5sum_getentry | ( | TSK_HDB_INFO * | hdb_info, | |
char * | hash, | |||
OFF_T | offset, | |||
TSK_HDB_FLAG_ENUM | flags, | |||
TSK_HDB_LOOKUP_FN | action, | |||
void * | cb_ptr | |||
) |
Find the corresponding name at a given offset.
The offset was likely determined from the index. The entries in the DB following the one specified are also processed if they have the same hash value and their name is different. The callback is called for each entry.
hdb_info | Hash database to get data from | |
hash | MD5 hash value that was searched for | |
offset | Byte offset where hash value should be located in db_file | |
flags | (not used) | |
action | Callback used for each entry found in lookup | |
cb_ptr | Pointer to data passed to callback |
uint8_t md5sum_makeindex | ( | TSK_HDB_INFO * | hdb_info, | |
TSK_TCHAR * | dbtype | |||
) |
Process the database to create a sorted index of it.
Consecutive entries with the same hash value are not added to the index, but will be found during lookup.
hdb_info | Hash database to make index of. | |
dbtype | Type of hash database (should always be TSK_HDB_DBTYPE_MD5SUM_STR) |
uint8_t md5sum_test | ( | FILE * | hFile | ) |
Test the file to see if it is a md5sum database.
hFile | File handle to hash database |
uint8_t nsrl_getentry | ( | TSK_HDB_INFO * | hdb_info, | |
char * | hash, | |||
OFF_T | offset, | |||
TSK_HDB_FLAG_ENUM | flags, | |||
TSK_HDB_LOOKUP_FN | action, | |||
void * | cb_ptr | |||
) |
Find the corresponding name at a given offset.
The offset was likely determined from the index. The entries in the DB following the one specified are also processed if they have the same hash value and their name is different. The callback is called for each entry.
hdb_info | Database to get data from. | |
hash | MD5/SHA-1 hash value that was searched for | |
offset | Byte offset where hash value should be located in db_file | |
flags | (not used) | |
action | Callback used for each entry found in lookup | |
cb_ptr | Pointer to data passed to callback |
uint8_t nsrl_makeindex | ( | TSK_HDB_INFO * | hdb_info, | |
TSK_TCHAR * | dbtype | |||
) |
Process the database to create a sorted index of it.
Consecutive entries with the same hash value are not added to the index, but will be found during lookup.
hdb_info | Hash database to make index of. | |
dbtype | Type of database |
uint8_t nsrl_test | ( | FILE * | hFile | ) |
Test the file to see if it is an NSRL database.
hFile | File handle to hash database |
uint8_t tsk_hdb_idxaddentry | ( | TSK_HDB_INFO * | hdb_info, | |
char * | hvalue, | |||
OFF_T | offset | |||
) |
Add an entry to the intermediate index file.
hdb_info | Hash database state info | |
hvalue | Hash value to add | |
offset | Byte offset of hash entry in original database. |
uint8_t tsk_hdb_idxfinalize | ( | TSK_HDB_INFO * | hdb_info | ) |
Finalize index creation process by sorting the index and removing the intermediate temp file.
hdb_info | Hash database state info structure. |
uint8_t tsk_hdb_idxinitialize | ( | TSK_HDB_INFO * | hdb_info, | |
TSK_TCHAR * | htype | |||
) |
Initialize the TSK hash DB index file.
This creates the intermediate file, which will have entries added to it. This file must be sorted before the process is finished.
hdb_info | Hash database state structure | |
htype | String of index type to create |