fatfs.c File Reference


Detailed Description

FAT file system code to handle basic file system processing for opening file system, processing sectors, and directory entries.

#include "fs_tools_i.h"
#include "fatfs.h"

Data Structures

struct  FATFS_PRINT_ADDR

Functions

int8_t is_clustalloc (FATFS_INFO *fatfs, DADDR_T clust)
int8_t is_sectalloc (FATFS_INFO *fatfs, DADDR_T sect)
uint8_t fatfs_block_walk (TSK_FS_INFO *fs, DADDR_T start_blk, DADDR_T end_blk, TSK_FS_BLOCK_FLAG_ENUM flags, TSK_FS_BLOCK_WALK_CB action, void *ptr)
TSK_RETVAL_ENUM fatfs_dinode_copy (FATFS_INFO *fatfs, TSK_FS_INODE *fs_inode, fatfs_dentry *in, DADDR_T sect, INUM_T inum)
 Copy the contents of a raw directry entry into a TSK_FS_INFO structure.
uint8_t fatfs_make_root (FATFS_INFO *fatfs, TSK_FS_INODE *fs_inode)
 Create an FS_INODE structure for the root directory.
uint8_t fatfs_isdentry (FATFS_INFO *fatfs, fatfs_dentry *de)
uint8_t fatfs_inode_walk (TSK_FS_INFO *fs, INUM_T start_inum, INUM_T end_inum, TSK_FS_INODE_FLAG_ENUM flags, TSK_FS_INODE_WALK_CB action, void *ptr)
uint8_t fatfs_file_walk_off (TSK_FS_INFO *fs, TSK_FS_INODE *fs_inode, uint32_t type, uint16_t id, OFF_T a_st_off, TSK_FS_FILE_FLAG_ENUM flags, TSK_FS_FILE_WALK_CB action, void *ptr)
 Calls a callback function with the contents of each block in a file.
uint8_t fatfs_jopen (TSK_FS_INFO *fs, INUM_T inum)
uint8_t fatfs_jentry_walk (TSK_FS_INFO *fs, int flags, TSK_FS_JENTRY_WALK_CB action, void *ptr)
uint8_t fatfs_jblk_walk (TSK_FS_INFO *fs, DADDR_T start, DADDR_T end, int flags, TSK_FS_JBLK_WALK_CB action, void *ptr)
TSK_FS_INFOfatfs_open (TSK_IMG_INFO *img_info, SSIZE_T offset, TSK_FS_INFO_TYPE_ENUM ftype, uint8_t test)
 Open part of a disk image as a FAT file system.


Function Documentation

TSK_RETVAL_ENUM fatfs_dinode_copy ( FATFS_INFO *  fatfs,
TSK_FS_INODE fs_inode,
fatfs_dentry *  in,
DADDR_T  sect,
INUM_T  inum 
)

Copy the contents of a raw directry entry into a TSK_FS_INFO structure.

Parameters:
fatfs File system that directory entry is from
fs_inode Generic inode structure to copy data into
in Directory entry to copy data from
sect Sector address where directory entry is from -- used to determine allocation status.
inum Address of the inode.
Returns:
1 on error and 0 on success. Errors should only occur for Unicode conversion problems and when this occurs the name will be NULL terminated (but with unknown contents).

uint8_t fatfs_file_walk_off ( TSK_FS_INFO fs,
TSK_FS_INODE fs_inode,
uint32_t  type,
uint16_t  id,
OFF_T  a_st_off,
TSK_FS_FILE_FLAG_ENUM  flags,
TSK_FS_FILE_WALK_CB  action,
void *  ptr 
)

Calls a callback function with the contents of each block in a file.

Flags: TSK_FS_FILE_FLAG_SLACK, TSK_FS_FILE_FLAG_AONLY, TSK_FS_FILE_FLAG_RECOVER

no notion of NOSPARSE or META

flags on action: TSK_FS_BLOCK_FLAG_CONT, TSK_FS_BLOCK_FLAG_META, TSK_FS_BLOCK_FLAG_ALLOC, TSK_FS_BLOCK_FLAG_UNALLOC

Parameters:
fs File system file is located in
fs_inode File to read and analyze
type Attribute type to read and analyze (does not apply to FAT)
id Attribute id to read and analyze (does not apply to FAT)
a_st_off Byte offset in the file to start calling the callback on (must be multiple of block size)
flags Flags to use while reading
action Callback function that is called for each block
ptr Pointer to data that is passed to the callback
Returns:
1 on error and 0 on success

uint8_t fatfs_make_root ( FATFS_INFO *  fatfs,
TSK_FS_INODE fs_inode 
)

Create an FS_INODE structure for the root directory.

FAT does not have a directory entry for the root directory, but this function collects the needed data to make one.

Parameters:
fatfs File system to analyze
fs_inode Inode structure to copy root directory information into.
Returns:
1 on error and 0 on success

TSK_FS_INFO* fatfs_open ( TSK_IMG_INFO img_info,
SSIZE_T  offset,
TSK_FS_INFO_TYPE_ENUM  ftype,
uint8_t  test 
)

Open part of a disk image as a FAT file system.

Parameters:
img_info Disk image to analyze
offset Byte offset where FAT file system starts
ftype Specific type of FAT file system
test NOT USED
Returns:
NULL on error or if data is not a FAT file system


Generated on Wed Nov 28 16:11:16 2007 for The Sleuth Kit (Incomplete) by  doxygen 1.5.1