#include "fs_tools.h"
#include <time.h>
#include <locale.h>
#include <sys/fcntl.h>
#include <sys/time.h>
Go to the source code of this file.
Data Structures | |
struct | TSK_FS_LOAD_FILE |
Defines | |
#define | NBBY 8 |
#define | isset(a, i) (((uint8_t *)(a))[(i)/NBBY] & (1<<((i)%NBBY))) |
#define | setbit(a, i) (((uint8_t *)(a))[(i)/NBBY] |= (1<<((i)%NBBY))) |
#define | tsk_fs_guessu16(fs, x, mag) tsk_guess_end_u16(&(fs->endian), (x), (mag)) |
#define | tsk_fs_guessu32(fs, x, mag) tsk_guess_end_u32(&(fs->endian), (x), (mag)) |
Functions | |
uint8_t | tsk_fs_load_file_action (TSK_FS_INFO *, DADDR_T, char *, size_t, TSK_FS_BLOCK_FLAG_ENUM, void *) |
TSK_FS_INFO * | ext2fs_open (TSK_IMG_INFO *, SSIZE_T, TSK_FS_INFO_TYPE_ENUM, uint8_t) |
Open part of a disk image as a Ext2/3 file system. | |
TSK_FS_INFO * | fatfs_open (TSK_IMG_INFO *, SSIZE_T, TSK_FS_INFO_TYPE_ENUM, uint8_t) |
Open part of a disk image as a FAT file system. | |
TSK_FS_INFO * | ffs_open (TSK_IMG_INFO *, SSIZE_T, TSK_FS_INFO_TYPE_ENUM) |
Open part of a disk image as a FFS/UFS file system. | |
TSK_FS_INFO * | ntfs_open (TSK_IMG_INFO *, SSIZE_T, TSK_FS_INFO_TYPE_ENUM, uint8_t) |
Open part of a disk image as an NTFS file system. | |
TSK_FS_INFO * | rawfs_open (TSK_IMG_INFO *, SSIZE_T) |
Open part of a disk image as a raw file system -- which basically means that it has no file system structure. | |
TSK_FS_INFO * | swapfs_open (TSK_IMG_INFO *, SSIZE_T) |
Open part of a disk image as "swap" space. | |
TSK_FS_INFO * | iso9660_open (TSK_IMG_INFO *, SSIZE_T, TSK_FS_INFO_TYPE_ENUM, uint8_t) |
TSK_FS_INFO * | hfs_open (TSK_IMG_INFO *, SSIZE_T, TSK_FS_INFO_TYPE_ENUM, uint8_t) |
TSK_FS_INFO* ext2fs_open | ( | TSK_IMG_INFO * | img_info, | |
SSIZE_T | offset, | |||
TSK_FS_INFO_TYPE_ENUM | ftype, | |||
uint8_t | test | |||
) |
Open part of a disk image as a Ext2/3 file system.
img_info | Disk image to analyze | |
offset | Byte offset where file system starts | |
ftype | Specific type of file system | |
test | NOT USED |
TSK_FS_INFO* fatfs_open | ( | TSK_IMG_INFO * | img_info, | |
SSIZE_T | offset, | |||
TSK_FS_INFO_TYPE_ENUM | ftype, | |||
uint8_t | test | |||
) |
Open part of a disk image as a FAT file system.
img_info | Disk image to analyze | |
offset | Byte offset where FAT file system starts | |
ftype | Specific type of FAT file system | |
test | NOT USED |
TSK_FS_INFO* ffs_open | ( | TSK_IMG_INFO * | img_info, | |
SSIZE_T | offset, | |||
TSK_FS_INFO_TYPE_ENUM | ftype | |||
) |
Open part of a disk image as a FFS/UFS file system.
img_info | Disk image to analyze | |
offset | Byte offset where file system starts | |
ftype | Specific type of file system |
TSK_FS_INFO* ntfs_open | ( | TSK_IMG_INFO * | img_info, | |
SSIZE_T | offset, | |||
TSK_FS_INFO_TYPE_ENUM | ftype, | |||
uint8_t | test | |||
) |
Open part of a disk image as an NTFS file system.
img_info | Disk image to analyze | |
offset | Byte offset where NTFS file system starts | |
ftype | Specific type of NTFS file system | |
test | NOT USED |
TSK_FS_INFO* rawfs_open | ( | TSK_IMG_INFO * | img_info, | |
SSIZE_T | offset | |||
) |
Open part of a disk image as a raw file system -- which basically means that it has no file system structure.
The data is considered to be in 512-byte sectors.
img_info | Disk image to analyze | |
offset | Byte offset where "file system" starts |
TSK_FS_INFO* swapfs_open | ( | TSK_IMG_INFO * | img_info, | |
SSIZE_T | offset | |||
) |
Open part of a disk image as "swap" space.
This assumes no structure exists. Data are organized into 4096-byte pages.
img_info | Disk image to analyze | |
offset | Byte offset where swap space starts. |