ffs.h File Reference


Detailed Description

Contains the structures and function APIs for FFS file system support.

Go to the source code of this file.

Data Structures

struct  ffs_csum1
struct  ffs_csum2
struct  ffs_sb1
struct  ffs_sb2
struct  ffs_cgd
struct  ffs_cgd2
struct  ffs_inode1
struct  ffs_inode1b
struct  ffs_inode2
struct  ffs_extattr
struct  ffs_dentry1
struct  ffs_dentry2
struct  FFS_INFO

Defines

#define PRI_FFSGRP   PRIu32
#define FFS_FIRSTINO   0
#define FFS_ROOTINO   2
#define FFS_NDADDR   12
#define FFS_NIADDR   3
#define UFS1_SBOFF   8192
#define UFS2_SBOFF   65536
#define UFS2_SBOFF2   262144
#define UFS1_FS_MAGIC   0x011954
#define UFS2_FS_MAGIC   0x19540119
#define FFS_MAXNAMLEN   255
#define FFS_MAXPATHLEN   1024
#define FFS_DIRBLKSIZ   512
#define FFS_DEV_BSIZE   512
#define FFS_SB_FLAG_UNCLEAN   0x01
#define FFS_SB_FLAG_SOFTDEP   0x02
#define FFS_SB_FLAG_NEEDFSCK   0x04
#define FFS_SB_FLAG_INDEXDIR   0x08
#define FFS_SB_FLAG_ACL   0x10
#define FFS_SB_FLAG_MULTILABEL   0x20
#define FFS_SB_FLAG_UPDATED   0x80
#define FFS_SB_OPT_TIME   0
#define FFS_SB_OPT_SPACE   1
#define FFS_IN_FMT   0170000
#define FFS_IN_FIFO   0010000
#define FFS_IN_CHR   0020000
#define FFS_IN_DIR   0040000
#define FFS_IN_BLK   0060000
#define FFS_IN_REG   0100000
#define FFS_IN_LNK   0120000
#define FFS_IN_SHAD   0130000
#define FFS_IN_SOCK   0140000
#define FFS_IN_WHT   0160000
#define FFS_ATTR_CONT(x)   ((((x) + 7 + 7) / 8) * 2)
#define FFS_DT_UNKNOWN   0
#define FFS_DT_FIFO   1
#define FFS_DT_CHR   2
#define FFS_DT_DIR   4
#define FFS_DT_BLK   6
#define FFS_DT_REG   8
#define FFS_DT_LNK   10
#define FFS_DT_SOCK   12
#define FFS_DT_WHT   14
#define FFS_DIRSIZ_lcl(len)   ((len + 8 + 3) & ~(3))
#define cgbase_lcl(fsi, fs, c)   ((DADDR_T)(tsk_gets32(fsi->endian, (fs)->cg_frag_num) * (c)))
#define cgstart_lcl(fsi, fs, c)
#define cgtod_lcl(fsi, fs, c)   ((DADDR_T)(cgstart_lcl(fsi, fs, c) + tsk_gets32(fsi->endian, (fs)->gd_off)))
#define cgimin_lcl(fsi, fs, c)   ((DADDR_T)(cgstart_lcl(fsi, fs, c) + tsk_gets32(fsi->endian, (fs)->ino_off)))
#define cgdmin_lcl(fsi, fs, c)   ((DADDR_T)(cgstart_lcl(fsi, fs, c) + tsk_gets32(fsi->endian, (fs)->dat_off)))
#define cgsblock_lcl(fsi, fs, c)   ((DADDR_T)(cgstart_lcl(fsi, fs, c) + tsk_gets32(fsi->endian, (fs)->sb_off)))
#define blkstofrags_lcl(fsi, fs, blks)   ((blks) << tsk_gets32(fsi->endian, (fs)->fs_fragshift))
#define itod_lcl(fsi, fs, x)
#define itoo_lcl(fsi, fs, x)   ((x) % (uint32_t)tsk_getu32(fsi->endian, (fs)->fs_inopb))
#define itog_lcl(fsi, fs, x)   (FFS_GRPNUM_T)((x) / tsk_gets32(fsi->endian, (fs)->cg_inode_num))
#define dtog_lcl(fsi, fs, d)   (FFS_GRPNUM_T)((d) / tsk_gets32(fsi->endian, (fs)->cg_frag_num))
#define cg_inosused_lcl(fsi, cgp)   ((uint8_t *)((uint8_t *)(cgp) + tsk_gets32(fsi->endian, (cgp)->cg_iusedoff)))
#define cg_blksfree_lcl(fsi, cgp)   ((uint8_t *)((uint8_t *)(cgp) + tsk_gets32(fsi->endian, (cgp)->cg_freeoff)))

Typedefs

typedef uint32_t FFS_GRPNUM_T

Functions

uint8_t ffs_dent_walk (TSK_FS_INFO *, INUM_T, TSK_FS_DENT_FLAG_ENUM, TSK_FS_DENT_TYPE_WALK_CB, void *)
 Process the contents of a directory and pass each file name to a callback function.


Define Documentation

#define cgstart_lcl ( fsi,
fs,
 ) 

Value:

((DADDR_T)((tsk_getu32((fsi)->endian, (fs)->magic) == UFS2_FS_MAGIC) ? \
        (cgbase_lcl(fsi, fs, c)) :  \
        (cgbase_lcl(fsi, fs, c) + tsk_gets32((fsi)->endian, (fs)->cg_delta) * \
         ((c) & ~(tsk_gets32((fsi)->endian, (fs)->cg_cyc_mask)))) ))

#define itod_lcl ( fsi,
fs,
 ) 

Value:

((DADDR_T)(cgimin_lcl(fsi, fs, itog_lcl(fsi, fs, x)) + \
      (blkstofrags_lcl(fsi, (fs), (((x)%(ULONG)tsk_gets32(fsi->endian, (fs)->cg_inode_num))/ \
          (ULONG)tsk_gets32(fsi->endian, (fs)->fs_inopb))))))


Function Documentation

uint8_t ffs_dent_walk ( TSK_FS_INFO fs,
INUM_T  inode,
TSK_FS_DENT_FLAG_ENUM  flags,
TSK_FS_DENT_TYPE_WALK_CB  action,
void *  ptr 
)

Process the contents of a directory and pass each file name to a callback function.

Parameters:
fs File system to analyze
inode Metadata address of directory to analyze
flags Flags used during analysis
action Callback function that is called for each file name
ptr Pointer to data that is passed to callback
Returns:
1 on error and 0 on success


Generated on Wed Nov 28 16:11:16 2007 for The Sleuth Kit (Incomplete) by  doxygen 1.5.1