nsrl_index.c File Reference


Detailed Description

NSRL specific functions to read the database.

#include "hashdb_tools_i.h"

Defines

#define is_valid_nsrl(x)
 Perform a basic check on a string to see if it starts with quotes and contains a possible SHA-1 value.

Typedefs

typedef enum TSK_HDB_NSRL_FORM_ENUM TSK_HDB_NSRL_FORM_ENUM

Enumerations

enum  TSK_HDB_NSRL_FORM_ENUM { TSK_HDB_NSRL_FORM1 = (1 << 0), TSK_HDB_NSRL_FORM2 = (1 << 1) }
 Version of NSRL Database. More...

Functions

uint8_t nsrl_test (FILE *hFile)
 Test the file to see if it is an NSRL database.
uint8_t nsrl_makeindex (TSK_HDB_INFO *hdb_info, TSK_TCHAR *dbtype)
 Process the database to create a sorted index of it.
uint8_t nsrl_getentry (TSK_HDB_INFO *hdb_info, char *hash, OFF_T offset, TSK_HDB_FLAG_ENUM flags, TSK_HDB_LOOKUP_FN action, void *cb_ptr)
 Find the corresponding name at a given offset.


Define Documentation

#define is_valid_nsrl (  ) 

Value:

( (strlen((x)) > TSK_HDB_HTYPE_SHA1_LEN + 4) && \
        ((x)[0] == '"') && ((x)[TSK_HDB_HTYPE_SHA1_LEN + 1] == '"') && \
        ((x)[TSK_HDB_HTYPE_SHA1_LEN + 2] == ',') && ((x)[TSK_HDB_HTYPE_SHA1_LEN + 3] == '"') )
Perform a basic check on a string to see if it starts with quotes and contains a possible SHA-1 value.

Parameters:
x string to test
Returns:
1 if NSRL and 0 if not


Enumeration Type Documentation

enum TSK_HDB_NSRL_FORM_ENUM

Version of NSRL Database.

Enumerator:
TSK_HDB_NSRL_FORM1  Version 1.
TSK_HDB_NSRL_FORM2  Version 2.


Function Documentation

uint8_t nsrl_getentry ( TSK_HDB_INFO hdb_info,
char *  hash,
OFF_T  offset,
TSK_HDB_FLAG_ENUM  flags,
TSK_HDB_LOOKUP_FN  action,
void *  cb_ptr 
)

Find the corresponding name at a given offset.

The offset was likely determined from the index. The entries in the DB following the one specified are also processed if they have the same hash value and their name is different. The callback is called for each entry.

Parameters:
hdb_info Database to get data from.
hash MD5/SHA-1 hash value that was searched for
offset Byte offset where hash value should be located in db_file
flags (not used)
action Callback used for each entry found in lookup
cb_ptr Pointer to data passed to callback
Returns:
1 on error and 0 on success

uint8_t nsrl_makeindex ( TSK_HDB_INFO hdb_info,
TSK_TCHAR *  dbtype 
)

Process the database to create a sorted index of it.

Consecutive entries with the same hash value are not added to the index, but will be found during lookup.

Parameters:
hdb_info Hash database to make index of.
dbtype Type of database
Returns:
1 on error and 0 on success.

uint8_t nsrl_test ( FILE *  hFile  ) 

Test the file to see if it is an NSRL database.

Parameters:
hFile File handle to hash database
Returns:
1 if NSRL and 0 if not


Generated on Wed Nov 28 16:11:18 2007 for The Sleuth Kit (Incomplete) by  doxygen 1.5.1