#include "fs_tools_i.h"
#include "ntfs.h"
#include <ctype.h>
Data Structures | |
struct | NTFS_COMP_INFO |
struct | NTFS_PRINT_ADDR |
Defines | |
#define | NSEC_BTWN_1601_1970 (uint64_t)(116444736000000000ULL) |
#define | NTFS_PRINT_WIDTH 8 |
Functions | |
uint32_t | nt2unixtime (uint64_t ntdate) |
uint8_t | ntfs_data_walk (NTFS_INFO *ntfs, INUM_T inum, TSK_FS_DATA *fs_data, int flags, TSK_FS_FILE_WALK_CB action, void *ptr) |
uint8_t | ntfs_attrname_lookup (TSK_FS_INFO *fs, uint16_t type, char *name, int len) |
uint8_t | ntfs_file_walk (TSK_FS_INFO *fs, TSK_FS_INODE *fs_inode, uint32_t type, uint16_t id, TSK_FS_FILE_FLAG_ENUM flags, TSK_FS_FILE_WALK_CB action, void *ptr) |
Walk the contents of a file and use the callback for each cluster. | |
uint8_t | ntfs_block_walk (TSK_FS_INFO *fs, DADDR_T start_blk, DADDR_T end_blk, TSK_FS_BLOCK_FLAG_ENUM flags, TSK_FS_BLOCK_WALK_CB action, void *ptr) |
uint8_t | ntfs_inode_walk (TSK_FS_INFO *fs, INUM_T start_inum, INUM_T end_inum, TSK_FS_INODE_FLAG_ENUM flags, TSK_FS_INODE_WALK_CB action, void *ptr) |
uint8_t | ntfs_jopen (TSK_FS_INFO *fs, INUM_T inum) |
uint8_t | ntfs_jentry_walk (TSK_FS_INFO *fs, int flags, TSK_FS_JENTRY_WALK_CB action, void *ptr) |
uint8_t | ntfs_jblk_walk (TSK_FS_INFO *fs, DADDR_T start, DADDR_T end, int flags, TSK_FS_JBLK_WALK_CB action, void *ptr) |
TSK_FS_INFO * | ntfs_open (TSK_IMG_INFO *img_info, SSIZE_T offset, TSK_FS_INFO_TYPE_ENUM ftype, uint8_t test) |
Open part of a disk image as an NTFS file system. |
uint8_t ntfs_file_walk | ( | TSK_FS_INFO * | fs, | |
TSK_FS_INODE * | fs_inode, | |||
uint32_t | type, | |||
uint16_t | id, | |||
TSK_FS_FILE_FLAG_ENUM | flags, | |||
TSK_FS_FILE_WALK_CB | action, | |||
void * | ptr | |||
) |
Walk the contents of a file and use the callback for each cluster.
This actually just finds the specific attribute and then calls data_walk.
If TSK_FS_FILE_FLAG_RECOVER is set, then error codes are set to _RECOVER so that errors can be more easily suppressed. No special recovery logic exists in this code.
action uses: TSK_FS_BLOCK_FLAG_CONT
No notion of meta with NTFS
fs | File system to analyze | |
fs_inode | Inode of file to analyze | |
type | Type id of attribute in file to walk (use 0 to use default for files and directories -- if default is not found then no error is generated!). | |
id | Id of attribute in file to walk (use flag of _NOID if this value is 0 because it is not specified -- in which case first entry is used). | |
flags | Flags to determine how walk should occur. Uses (TSK_FS_FILE_FLAG_AONLY, TSK_FS_FILE_FLAG_SLACK, TSK_FS_FILE_FLAG_NOSPARSE TSK_FS_FILE_FLAG_NOID, TSK_FS_FILE_FLAG_RECOVER). | |
action | Callback that is called for each cluster | |
ptr | Pointer to data that will be passed to callback. |
TSK_FS_INFO* ntfs_open | ( | TSK_IMG_INFO * | img_info, | |
SSIZE_T | offset, | |||
TSK_FS_INFO_TYPE_ENUM | ftype, | |||
uint8_t | test | |||
) |
Open part of a disk image as an NTFS file system.
img_info | Disk image to analyze | |
offset | Byte offset where NTFS file system starts | |
ftype | Specific type of NTFS file system | |
test | NOT USED |