ffs.c File Reference


Detailed Description

General UFS / FFS file system functions.

#include "fs_tools_i.h"
#include "ffs.h"

Data Structures

struct  FFS_PRINT_ADDR

Defines

#define FFS_INDIR_SIZ   64

Functions

uint8_t ffs_inode_walk (TSK_FS_INFO *fs, INUM_T start_inum, INUM_T end_inum, TSK_FS_INODE_FLAG_ENUM flags, TSK_FS_INODE_WALK_CB action, void *ptr)
uint8_t ffs_block_walk (TSK_FS_INFO *fs, DADDR_T start_blk, DADDR_T end_blk, TSK_FS_BLOCK_FLAG_ENUM flags, TSK_FS_BLOCK_WALK_CB action, void *ptr)
uint8_t ffs_file_walk (TSK_FS_INFO *fs, TSK_FS_INODE *inode, uint32_t type, uint16_t id, TSK_FS_FILE_FLAG_ENUM flags, TSK_FS_FILE_WALK_CB action, void *ptr)
 Calls a callback function with the contents of each block in a file.
uint8_t ffs_jopen (TSK_FS_INFO *fs, INUM_T inum)
uint8_t ffs_jentry_walk (TSK_FS_INFO *fs, int flags, TSK_FS_JENTRY_WALK_CB action, void *ptr)
uint8_t ffs_jblk_walk (TSK_FS_INFO *fs, DADDR_T start, DADDR_T end, int flags, TSK_FS_JBLK_WALK_CB action, void *ptr)
TSK_FS_INFOffs_open (TSK_IMG_INFO *img_info, SSIZE_T offset, TSK_FS_INFO_TYPE_ENUM ftype)
 Open part of a disk image as a FFS/UFS file system.


Function Documentation

uint8_t ffs_file_walk ( TSK_FS_INFO fs,
TSK_FS_INODE inode,
uint32_t  type,
uint16_t  id,
TSK_FS_FILE_FLAG_ENUM  flags,
TSK_FS_FILE_WALK_CB  action,
void *  ptr 
)

Calls a callback function with the contents of each block in a file.

flag values: TSK_FS_FILE_FLAG_NOSPARSE, TSK_FS_FILE_FLAG_AONLY, TSK_FS_FILE_FLAG_SLACK TSK_FS_FILE_FLAG_META

If TSK_FS_FILE_FLAG_RECOVER is set, then most error codes are set to _RECOVER. No special recovery logic exists in this code.

The action will use the flags: TSK_FS_BLOCK_FLAG_CONT, TSK_FS_BLOCK_FLAG_META -- @@ Currently do not do _ALLOC and _UNALLOC

Parameters:
fs File system file is located in
inode File to read and analyze
type Attribute type to read and analyze (does not apply to FFS)
id Attribute id to read and analyze (does not apply to FFS)
flags Flags to use while reading
action Callback function that is called for each block
ptr Pointer to data that is passed to the callback
Returns:
1 on error and 0 on success

TSK_FS_INFO* ffs_open ( TSK_IMG_INFO img_info,
SSIZE_T  offset,
TSK_FS_INFO_TYPE_ENUM  ftype 
)

Open part of a disk image as a FFS/UFS file system.

Parameters:
img_info Disk image to analyze
offset Byte offset where file system starts
ftype Specific type of file system
Returns:
NULL on error or if data is not a FFS file system


Generated on Wed Nov 28 16:11:16 2007 for The Sleuth Kit (Incomplete) by  doxygen 1.5.1