fs_tools_i.h File Reference


Detailed Description

Contains the structures and function APIs that are needed by internal file system code only.

#include "fs_tools.h"
#include <time.h>
#include <locale.h>
#include <sys/fcntl.h>
#include <sys/time.h>

Go to the source code of this file.

Data Structures

struct  TSK_FS_LOAD_FILE

Defines

#define NBBY   8
#define isset(a, i)   (((uint8_t *)(a))[(i)/NBBY] & (1<<((i)%NBBY)))
#define setbit(a, i)   (((uint8_t *)(a))[(i)/NBBY] |= (1<<((i)%NBBY)))
#define tsk_fs_guessu16(fs, x, mag)   tsk_guess_end_u16(&(fs->endian), (x), (mag))
#define tsk_fs_guessu32(fs, x, mag)   tsk_guess_end_u32(&(fs->endian), (x), (mag))

Functions

uint8_t tsk_fs_load_file_action (TSK_FS_INFO *, DADDR_T, char *, size_t, TSK_FS_BLOCK_FLAG_ENUM, void *)
TSK_FS_INFOext2fs_open (TSK_IMG_INFO *, SSIZE_T, TSK_FS_INFO_TYPE_ENUM, uint8_t)
 Open part of a disk image as a Ext2/3 file system.
TSK_FS_INFOfatfs_open (TSK_IMG_INFO *, SSIZE_T, TSK_FS_INFO_TYPE_ENUM, uint8_t)
 Open part of a disk image as a FAT file system.
TSK_FS_INFOffs_open (TSK_IMG_INFO *, SSIZE_T, TSK_FS_INFO_TYPE_ENUM)
 Open part of a disk image as a FFS/UFS file system.
TSK_FS_INFOntfs_open (TSK_IMG_INFO *, SSIZE_T, TSK_FS_INFO_TYPE_ENUM, uint8_t)
 Open part of a disk image as an NTFS file system.
TSK_FS_INFOrawfs_open (TSK_IMG_INFO *, SSIZE_T)
 Open part of a disk image as a raw file system -- which basically means that it has no file system structure.
TSK_FS_INFOswapfs_open (TSK_IMG_INFO *, SSIZE_T)
 Open part of a disk image as "swap" space.
TSK_FS_INFOiso9660_open (TSK_IMG_INFO *, SSIZE_T, TSK_FS_INFO_TYPE_ENUM, uint8_t)
TSK_FS_INFOhfs_open (TSK_IMG_INFO *, SSIZE_T, TSK_FS_INFO_TYPE_ENUM, uint8_t)


Function Documentation

TSK_FS_INFO* ext2fs_open ( TSK_IMG_INFO img_info,
SSIZE_T  offset,
TSK_FS_INFO_TYPE_ENUM  ftype,
uint8_t  test 
)

Open part of a disk image as a Ext2/3 file system.

Parameters:
img_info Disk image to analyze
offset Byte offset where file system starts
ftype Specific type of file system
test NOT USED
Returns:
NULL on error or if data is not an Ext2/3 file system

TSK_FS_INFO* fatfs_open ( TSK_IMG_INFO img_info,
SSIZE_T  offset,
TSK_FS_INFO_TYPE_ENUM  ftype,
uint8_t  test 
)

Open part of a disk image as a FAT file system.

Parameters:
img_info Disk image to analyze
offset Byte offset where FAT file system starts
ftype Specific type of FAT file system
test NOT USED
Returns:
NULL on error or if data is not a FAT file system

TSK_FS_INFO* ffs_open ( TSK_IMG_INFO img_info,
SSIZE_T  offset,
TSK_FS_INFO_TYPE_ENUM  ftype 
)

Open part of a disk image as a FFS/UFS file system.

Parameters:
img_info Disk image to analyze
offset Byte offset where file system starts
ftype Specific type of file system
Returns:
NULL on error or if data is not a FFS file system

TSK_FS_INFO* ntfs_open ( TSK_IMG_INFO img_info,
SSIZE_T  offset,
TSK_FS_INFO_TYPE_ENUM  ftype,
uint8_t  test 
)

Open part of a disk image as an NTFS file system.

Parameters:
img_info Disk image to analyze
offset Byte offset where NTFS file system starts
ftype Specific type of NTFS file system
test NOT USED
Returns:
NULL on error or if data is not an NTFS file system

TSK_FS_INFO* rawfs_open ( TSK_IMG_INFO img_info,
SSIZE_T  offset 
)

Open part of a disk image as a raw file system -- which basically means that it has no file system structure.

The data is considered to be in 512-byte sectors.

Parameters:
img_info Disk image to analyze
offset Byte offset where "file system" starts
Returns:
NULL on error

TSK_FS_INFO* swapfs_open ( TSK_IMG_INFO img_info,
SSIZE_T  offset 
)

Open part of a disk image as "swap" space.

This assumes no structure exists. Data are organized into 4096-byte pages.

Parameters:
img_info Disk image to analyze
offset Byte offset where swap space starts.
Returns:
NULL on error


Generated on Wed Nov 28 16:11:17 2007 for The Sleuth Kit (Incomplete) by  doxygen 1.5.1