00001
00002
00003
00004
00005
00006
00007
00008
00009
00010
00011
00012
00013
00014
00015
00016
00017
00018
00019
00020
00021
00022
00023
00024
00025
00026
00027
00028
00029
00030
00031
00032
00033
00034
00035
00036
00037
00038
00039
00040
00041
00042
00043
00044
00045
00046
00047
00048
00049
00050
00051
00052
00053
00054
00055
00056
00057
00058
00059
00065 #ifndef _HFS_H
00066 #define _HFS_H
00067
00068
00069
00070
00071
00072
00073
00074
00075
00076
00077
00078 #define HFS_MAGIC 0x4244
00079 #define HFSPLUS_MAGIC 0x482b
00080
00081 #define HFS_SBOFF 1024
00082 #define HFS_NDADDR 0001
00083 #define HFS_NIADDR 0001
00084
00085 #define HFS_FIRST_USER_CNID 16
00086
00087
00088 #define HFS_BTREE_LEAF_NODE -1
00089 #define HFS_BTREE_INDEX_NODE 0
00090 #define HFS_BTREE_HEADER_NODE 1
00091 #define HFS_BTREE_MAP_NODE 2
00092
00093 #define HFS_MAXNAMLEN 255
00094
00095 #define HFS_ROOT_INUM 2
00096
00097
00098 #define HFS_FOLDER_RECORD 0x0001
00099 #define HFS_FILE_RECORD 0X0002
00100 #define HFS_FOLDER_THREAD 0x0003
00101 #define HFS_FILE_THREAD 0x0004
00102
00103
00104
00105
00106
00107
00108
00109 #define NSEC_BTWN_1904_1970 (uint32_t) 2082844800U
00110
00111 #define HFS_BIT_VOLUME_UNMOUNTED (uint32_t)(1 << 8)
00112 #define HFS_BIT_VOLUME_INCONSISTENT (uint32_t)(1 << 11)
00113 #define HFS_BIT_VOLUME_JOURNALED (uint32_t)(1 << 13)
00114
00115
00116
00117
00118
00119
00120 typedef struct {
00121 uint16_t length[2];
00122 uint16_t unicode[255];
00123 } hfs_uni_str;
00124
00125
00126 typedef struct {
00127 uint8_t owner[4];
00128 uint8_t group[4];
00129 uint8_t a_flags;
00130 uint8_t o_flags;
00131 uint8_t mode[2];
00132 union {
00133 uint8_t inum[4];
00134 uint8_t nlink[4];
00135 uint8_t raw[4];
00136 } special;
00137 } hfs_access_perm;
00138
00139 typedef struct {
00140 uint32_t uid;
00141 uint32_t gid;
00142 uint32_t mode;
00143 uint32_t dev;
00144 } hfs_file_perm;
00145
00146
00147
00148 struct hfs_ext_desc {
00149 uint8_t start_blk[4];
00150 uint8_t blk_cnt[4];
00151 };
00152
00153 typedef struct hfs_ext_desc hfs_ext_desc;
00154
00155
00156
00157 struct hfs_fork {
00158 uint8_t logic_sz[8];
00159 uint8_t clmp_sz[4];
00160 uint8_t total_blk[4];
00161 hfs_ext_desc extents[8];
00162 };
00163
00164 typedef struct hfs_fork hfs_fork;
00165
00166
00167
00168
00169 typedef struct {
00170 uint8_t signature[2];
00171 uint8_t version[2];
00172 uint8_t attr[4];
00173 uint8_t last_mnt_ver[4];
00174 uint8_t jinfo_blk[4];
00175 uint8_t c_date[4];
00176 uint8_t m_date[4];
00177 uint8_t bkup_date[4];
00178 uint8_t chk_date[4];
00179 uint8_t file_cnt[4];
00180 uint8_t fldr_cnt[4];
00181 uint8_t blk_sz[4];
00182 uint8_t blk_cnt[4];
00183 uint8_t free_blks[4];
00184 uint8_t next_alloc[4];
00185 uint8_t rsrc_clmp_sz[4];
00186 uint8_t data_clmp_sz[4];
00187 uint8_t next_cat_id[4];
00188 uint8_t write_cnt[4];
00189 uint8_t enc_bmp[8];
00190 uint8_t finder_info[32];
00191 hfs_fork alloc_file;
00192 hfs_fork ext_file;
00193 hfs_fork cat_file;
00194 hfs_fork attr_file;
00195 hfs_fork start_file;
00196 } hfs_sb;
00197
00198 typedef struct {
00199 uint8_t key_len[2];
00200 uint8_t parent_cnid[4];
00201 uint8_t name[510];
00202 } hfs_cat_key;
00203
00204 typedef struct {
00205 uint32_t inum;
00206 uint32_t parent;
00207 uint32_t node;
00208 DADDR_T offs;
00209 } htsk_fs_inode_mode_struct;
00210
00211 typedef struct {
00212 uint8_t flink[4];
00213 uint8_t blink[4];
00214 int8_t kind;
00215 uint8_t height;
00216 uint8_t num_rec[2];
00217 uint8_t res[2];
00218 } hfs_btree_node;
00219
00220 typedef struct {
00221 uint8_t depth[2];
00222 uint8_t root[4];
00223 uint8_t leaf[4];
00224 uint8_t firstleaf[4];
00225 uint8_t lastleaf[4];
00226 uint8_t size[2];
00227 uint8_t max_len[2];
00228 uint8_t total[4];
00229 uint8_t free[4];
00230 uint8_t res[2];
00231 uint8_t clmp_sz[4];
00232 uint8_t bt_type;
00233 uint8_t k_type;
00234 uint8_t attr[4];
00235 uint8_t res2[64];
00236 } hfs_btree_header_record;
00237
00238 typedef struct {
00239 int8_t v[2];
00240 int8_t h[2];
00241 } hfs_point;
00242
00243 typedef struct {
00244 uint8_t file_type[4];
00245 uint8_t file_cr[4];
00246 uint8_t flags[2];
00247 hfs_point loc;
00248 uint8_t res[2];
00249 } hfs_fileinfo;
00250
00251 typedef struct {
00252 uint8_t res1[8];
00253 uint8_t extflags[2];
00254 uint8_t res2[2];
00255 uint8_t folderid[4];
00256 } hfs_extendedfileinfo;
00257
00258 typedef struct {
00259 uint8_t rec_type[2];
00260 uint8_t flags[2];
00261 uint8_t valence[4];
00262 uint8_t cnid[4];
00263 uint8_t ctime[4];
00264 uint8_t cmtime[4];
00265 uint8_t amtime[4];
00266 uint8_t atime[4];
00267 uint8_t bkup_time[4];
00268 hfs_access_perm perm;
00269 hfs_fileinfo u_info;
00270 hfs_extendedfileinfo f_info;
00271 uint8_t txt_enc[4];
00272 uint8_t res[4];
00273 } hfs_folder;
00274
00275 typedef struct {
00276 uint8_t rec_type[2];
00277 uint8_t flags[2];
00278 uint8_t res[4];
00279 uint8_t cnid[4];
00280 uint8_t ctime[4];
00281 uint8_t cmtime[4];
00282 uint8_t attr_mtime[4];
00283 uint8_t atime[4];
00284 uint8_t bkup_date[4];
00285 hfs_access_perm perm;
00286 hfs_fileinfo u_info;
00287 hfs_extendedfileinfo f_info;
00288 uint8_t text_enc[4];
00289 uint8_t res2[4];
00290 hfs_fork data;
00291 hfs_fork resource;
00292 } hfs_file;
00293
00294 typedef struct {
00295 int16_t type;
00296 int16_t res;
00297 uint8_t cnid[4];
00298 char name[255];
00299 } hfs_thread;
00300
00301 typedef struct {
00302 TSK_FS_INFO fs_info;
00303 hfs_sb *fs;
00304 TSK_FS_INODE *cat_inode;
00305
00306 htsk_fs_inode_mode_struct *inodes;
00307 uint8_t *block_map;
00308 uint8_t *leaf_map;
00309 uint8_t *del_map;
00310 hfs_file *cat;
00311 int flags;
00312 INUM_T inum;
00313
00314 hfs_btree_header_record *hdr;
00315
00316 OFF_T key;
00317
00318 } HFS_INFO;
00319
00320
00321
00322
00323 typedef struct {
00324 uint8_t flags[4];
00325 uint8_t dev_sig[32];
00326 uint8_t offs[8];
00327 uint8_t size[8];
00328 uint8_t res[128];
00329 } hfs_journ_sb;
00330
00331
00332
00333
00334 extern uint8_t hfs_dent_walk(TSK_FS_INFO *, INUM_T, TSK_FS_DENT_FLAG_ENUM,
00335 TSK_FS_DENT_TYPE_WALK_CB, void *);
00336 extern uint8_t hfs_jopen(TSK_FS_INFO *, INUM_T);
00337 extern uint8_t hfs_jblk_walk(TSK_FS_INFO *, DADDR_T, DADDR_T, int,
00338 TSK_FS_JBLK_WALK_CB, void *);
00339 extern uint8_t hfs_jentry_walk(TSK_FS_INFO *, int, TSK_FS_JENTRY_WALK_CB,
00340 void *);
00341 #endif