#include "img_tools.h"
#include <sys/types.h>
Go to the source code of this file.
Data Structures | |
struct | TSK_MM_INFO |
struct | TSK_MM_PART |
Linked list entry that describes a volume in a generic way. More... | |
Defines | |
#define | tsk_mm_guessu16(mm, x, mag) tsk_guess_end_u16(&(mm->endian), (x), (mag)) |
#define | tsk_mm_guessu32(mm, x, mag) tsk_guess_end_u32(&(mm->endian), (x), (mag)) |
Typedefs | |
typedef TSK_MM_INFO | TSK_MM_INFO |
typedef TSK_MM_PART | TSK_MM_PART |
typedef uint8_t(*) | TSK_MM_PART_WALK_CB (TSK_MM_INFO *, PNUM_T, TSK_MM_PART *, int, void *) |
typedef enum TSK_MM_INFO_TYPE_ENUM | TSK_MM_INFO_TYPE_ENUM |
typedef enum TSK_MM_PART_TYPE_ENUM | TSK_MM_PART_TYPE_ENUM |
Enumerations | |
enum | TSK_MM_INFO_TYPE_ENUM { TSK_MM_INFO_TYPE_UNSUPP = 0, TSK_MM_INFO_TYPE_DOS = 1, TSK_MM_INFO_TYPE_BSD = 2, TSK_MM_INFO_TYPE_SUN = 3, TSK_MM_INFO_TYPE_MAC = 4, TSK_MM_INFO_TYPE_GPT = 5 } |
Flags for the partition type. More... | |
enum | TSK_MM_PART_TYPE_ENUM { TSK_MM_PART_TYPE_DESC = (1 << 0), TSK_MM_PART_TYPE_VOL = (1 << 1) } |
Flag values that describe the partitions in the VS. More... | |
Functions | |
uint8_t | tsk_mm_part_unused (TSK_MM_INFO *) |
void | tsk_mm_part_print (TSK_MM_INFO *) |
TSK_MM_PART * | tsk_mm_part_add (TSK_MM_INFO *, DADDR_T, DADDR_T, TSK_MM_PART_TYPE_ENUM, char *, int8_t, int8_t) |
void | tsk_mm_part_free (TSK_MM_INFO *) |
TSK_MM_INFO_TYPE_ENUM | tsk_mm_parse_type (const TSK_TCHAR *) |
char * | tsk_mm_get_type (TSK_MM_INFO_TYPE_ENUM) |
TSK_MM_INFO * | tsk_mm_open (TSK_IMG_INFO *, DADDR_T, const TSK_TCHAR *) |
Open a disk image and process the media management system data. | |
SSIZE_T | tsk_mm_read_block_nobuf (TSK_MM_INFO *, char *, OFF_T, DADDR_T) |
void | tsk_mm_print_types (FILE *) |
TSK_MM_INFO * | tsk_mm_dos_open (TSK_IMG_INFO *, DADDR_T, uint8_t) |
TSK_MM_INFO * | tsk_mm_mac_open (TSK_IMG_INFO *, DADDR_T) |
TSK_MM_INFO * | tsk_mm_bsd_open (TSK_IMG_INFO *, DADDR_T) |
TSK_MM_INFO * | tsk_mm_sun_open (TSK_IMG_INFO *, DADDR_T) |
TSK_MM_INFO * | tsk_mm_gpt_open (TSK_IMG_INFO *, DADDR_T) |
TSK_MM_INFO* tsk_mm_open | ( | TSK_IMG_INFO * | img_info, | |
DADDR_T | offset, | |||
const TSK_TCHAR * | type | |||
) |
Open a disk image and process the media management system data.
This calls MM specific code to determine the type and collect data.
img_info | The opened disk image. | |
offset | Byte offset in the disk image to start analyzing from. | |
type | String name of type specified by user (autodetect is used if this is NULL). |