The raw file system is used to process an arbitrary chunk of data as 512-byte sectors that have no other structure. This means that you can use the data-level tools, but that is it.
#include "fs_tools_i.h"
Functions | |
uint8_t | rawfs_inode_walk (TSK_FS_INFO *fs, INUM_T start_inum, INUM_T end_inum, TSK_FS_INODE_FLAG_ENUM flags, TSK_FS_INODE_WALK_CB action, void *ptr) |
uint8_t | rawfs_block_walk (TSK_FS_INFO *fs, DADDR_T start_blk, DADDR_T end_blk, TSK_FS_BLOCK_FLAG_ENUM flags, TSK_FS_BLOCK_WALK_CB action, void *ptr) |
uint8_t | rawfs_file_walk (TSK_FS_INFO *fs, TSK_FS_INODE *inode, uint32_t type, uint16_t id, TSK_FS_FILE_FLAG_ENUM flags, TSK_FS_FILE_WALK_CB action, void *ptr) |
uint8_t | rawfs_dent_walk (TSK_FS_INFO *fs, INUM_T inode, TSK_FS_DENT_FLAG_ENUM flags, TSK_FS_DENT_TYPE_WALK_CB action, void *ptr) |
uint8_t | rawfs_jopen (TSK_FS_INFO *fs, INUM_T inum) |
uint8_t | rawfs_jentry_walk (TSK_FS_INFO *fs, int flags, TSK_FS_JENTRY_WALK_CB action, void *ptr) |
uint8_t | rawfs_jblk_walk (TSK_FS_INFO *fs, DADDR_T start, DADDR_T end, int flags, TSK_FS_JBLK_WALK_CB action, void *ptr) |
TSK_FS_INFO * | rawfs_open (TSK_IMG_INFO *img_info, SSIZE_T offset) |
Open part of a disk image as a raw file system -- which basically means that it has no file system structure. |
TSK_FS_INFO* rawfs_open | ( | TSK_IMG_INFO * | img_info, | |
SSIZE_T | offset | |||
) |
Open part of a disk image as a raw file system -- which basically means that it has no file system structure.
The data is considered to be in 512-byte sectors.
img_info | Disk image to analyze | |
offset | Byte offset where "file system" starts |