TSK_FS_INFO Struct Reference

#include <fs_tools.h>


Detailed Description

Stores state information for an open file system.

One of these are generated for each open files system and it contains file system-type specific data. These values are all filled in by the file system code and not the caller functions.


Data Fields

TSK_IMG_INFOimg_info
 Pointer to the image layer state.
SSIZE_T offset
 Byte offset into img_info that fs starts.
INUM_T inum_count
 Number of inodes.
INUM_T root_inum
 Address of root inode.
INUM_T first_inum
 Address of first valid inode.
INUM_T last_inum
 Address of last valid inode.
DADDR_T block_count
 Number of blocks in fs.
DADDR_T first_block
 Address of first block.
DADDR_T last_block
 Address of last block as reported by file system (could be larger than last_block if end of image does not exist).
DADDR_T last_block_act
 Address of last block -- adjusted so that it is equal to the last block in the image or volume (if image is not complete).
unsigned int block_size
 Size of each block (in bytes).
unsigned int dev_bsize
 Size of device block (typically always 512).
INUM_T journ_inum
 Address of journal inode.
TSK_FS_INFO_TYPE_ENUM ftype
 type of file system
char * duname
 string "name" of data unit type
TSK_FS_INFO_FLAG_ENUM flags
 flags for image
uint8_t endian
 Endian order (see auxtools/tsk_endian.h).
TSK_LIST * list_inum_named
 List of unallocated inodes that are pointed to by a file name -- Used to find orphans.
uint8_t(* block_walk )(TSK_FS_INFO *fs, DADDR_T start, DADDR_T end, TSK_FS_BLOCK_FLAG_ENUM flags, TSK_FS_BLOCK_WALK_CB cb, void *ptr)
 Pointer to file system-specific function that passes a range of blocks to a callback function.
uint8_t(* inode_walk )(TSK_FS_INFO *fs, INUM_T start, INUM_T end, TSK_FS_INODE_FLAG_ENUM flags, TSK_FS_INODE_WALK_CB cb, void *ptr)
 Pointer to file system-specific function that passes a range of inodes to a callback function.
TSK_FS_INODE *(* inode_lookup )(TSK_FS_INFO *fs, INUM_T addr)
 Pointer to file system-specific function that looks up a file and returns the info in a generic format.
uint8_t(* istat )(TSK_FS_INFO *fs, FILE *hFile, INUM_T inum, DADDR_T numblock, int32_t sec_skew)
 Pointer to file system specific function that prints details on a specific file to a file handle.
uint8_t(* file_walk )(TSK_FS_INFO *fs, TSK_FS_INODE *fs_inode, uint32_t type, uint16_t id, TSK_FS_FILE_FLAG_ENUM flags, TSK_FS_FILE_WALK_CB cb, void *ptr)
 Pointer to a file system-specific function that calls a callback function with the contents of each block in a file.
uint8_t(* dent_walk )(TSK_FS_INFO *fs, INUM_T inode, TSK_FS_DENT_FLAG_ENUM flags, TSK_FS_DENT_TYPE_WALK_CB action, void *ptr)
 Pointer to file system-specific function that processes the contents of a directory and passes each file name to a callback function.
uint8_t(* jopen )(TSK_FS_INFO *, INUM_T)
 Open the journal.
uint8_t(* jblk_walk )(TSK_FS_INFO *, DADDR_T, DADDR_T, int, TSK_FS_JBLK_WALK_CB, void *)
 Walk the blocks in a journal.
uint8_t(* jentry_walk )(TSK_FS_INFO *, int, TSK_FS_JENTRY_WALK_CB, void *)
 Walk the entries in a journal.
uint8_t(* fsstat )(TSK_FS_INFO *fs, FILE *hFile)
 Pointer to file system-specific function that prints file system details to a file handle.
uint8_t(* fscheck )(TSK_FS_INFO *, FILE *)
 Check the integrity / sanity of the file system (not implemented).
void(* close )(TSK_FS_INFO *fs)
 Pointer to file system-specific function that closes the file system and frees the allocated memory.


Field Documentation

uint8_t(* TSK_FS_INFO::block_walk)(TSK_FS_INFO *fs, DADDR_T start, DADDR_T end, TSK_FS_BLOCK_FLAG_ENUM flags, TSK_FS_BLOCK_WALK_CB cb, void *ptr)

Pointer to file system-specific function that passes a range of blocks to a callback function.

Parameters:
fs File system to analyze
start Starting block in range to walk from
end Ending block in range to walk to
flags Flags for walking
cb Callback function
ptr Pointer to data that is passed to callback
Returns:
1 on error and 0 on success

uint8_t(* TSK_FS_INFO::inode_walk)(TSK_FS_INFO *fs, INUM_T start, INUM_T end, TSK_FS_INODE_FLAG_ENUM flags, TSK_FS_INODE_WALK_CB cb, void *ptr)

Pointer to file system-specific function that passes a range of inodes to a callback function.

Parameters:
fs File system to analyze
start Starting inode in range to walk from
end Ending inode in range to walk to
flags Flags for walking
cb Callback function
ptr Pointer to data that is passed to callback
Returns:
1 on error and 0 on success

TSK_FS_INODE*(* TSK_FS_INFO::inode_lookup)(TSK_FS_INFO *fs, INUM_T addr)

Pointer to file system-specific function that looks up a file and returns the info in a generic format.

Parameters:
fs File system to analyze
addr Metadata address of file to lookup
Returns:
NULL on error

uint8_t(* TSK_FS_INFO::istat)(TSK_FS_INFO *fs, FILE *hFile, INUM_T inum, DADDR_T numblock, int32_t sec_skew)

Pointer to file system specific function that prints details on a specific file to a file handle.

Parameters:
fs File system file is located in
hFile File handle to print text to
inum Address of file in file system
numblock The number of blocks in file to force print (can go beyond file size)
sec_skew Clock skew in seconds to also print times in
Returns:
1 on error and 0 on success

uint8_t(* TSK_FS_INFO::file_walk)(TSK_FS_INFO *fs, TSK_FS_INODE *fs_inode, uint32_t type, uint16_t id, TSK_FS_FILE_FLAG_ENUM flags, TSK_FS_FILE_WALK_CB cb, void *ptr)

Pointer to a file system-specific function that calls a callback function with the contents of each block in a file.

Parameters:
fs File system file is located in
fs_inode File to read and analyze
type Attribute type to read and analyze (does not apply to all file systems)
id Attribute id to read and analyze (does not apply to all file systems)
flags Flags to use while reading
cb Callback function that is called for each block
ptr Pointer to data that is passed to the callback
Returns:
1 on error and 0 on success

uint8_t(* TSK_FS_INFO::dent_walk)(TSK_FS_INFO *fs, INUM_T inode, TSK_FS_DENT_FLAG_ENUM flags, TSK_FS_DENT_TYPE_WALK_CB action, void *ptr)

Pointer to file system-specific function that processes the contents of a directory and passes each file name to a callback function.

Parameters:
fs File system to analyze
inode Metadata address of directory to analyze
flags Flags used during analysis
action Callback function that is called for each file name
ptr Pointer to data that is passed to callback
Returns:
1 on error and 0 on success

uint8_t(* TSK_FS_INFO::fsstat)(TSK_FS_INFO *fs, FILE *hFile)

Pointer to file system-specific function that prints file system details to a file handle.

Parameters:
fs File system to print details on
hFile File handle to print text to
Returns:
1 on error and 0 on success

void(* TSK_FS_INFO::close)(TSK_FS_INFO *fs)

Pointer to file system-specific function that closes the file system and frees the allocated memory.

Parameters:
fs File system to close


The documentation for this struct was generated from the following file:
Generated on Wed Nov 28 16:11:18 2007 for The Sleuth Kit (Incomplete) by  doxygen 1.5.1